DocuSign Phishing Emails

DocuSign, a trusted tool for secure document signing and sharing, has become a target for cybercriminals to launch phishing attacks.

These sophisticated attacks exploit the trust users place in official DocuSign emails, making them particularly dangerous. These emails often look legitimate, coming from verified DocuSign domains. They may include genuine-looking footers, complete with Alternate Signing Methods that DocuSign advises users to check for authenticity.

However, these emails may contain malicious links leading to credential theft or malware downloads.

Example:

Attackers often use SUBJECT LINES designed to create URGENCY or LEGITIMACY, such as:

• “Payment Advice Notification”
• “Complete with DocuSign: Remittance Advice .pdf”
• “ACH/EFT Deposited, Please review and sign”
• “Reminder: Complete with DocuSign”

Other key red flags include:

Lack of an Alternate Signing Method: Official DocuSign emails always include an alternate method to sign documents. Its absence signals a potential spoof.

Suspicious “Reply-To” Addresses: If the reply-to domain doesn’t align with your organization or trusted contacts, exercise caution

To safeguard against these attacks, follow these best practices:

1) Be Skeptical of Unsolicited Emails: If you weren’t expecting a DocuSign request, treat the email as suspicious until verified.

2) Check for Alternate Signing Methods: Legitimate DocuSign emails always include this feature in the footer.

3) Review the Reply-To Field: Ensure it aligns with a trusted domain or contact.

Stay alert, stay informed, and stay safe!

---