“Message Sent Using DocuSign Service” Email Scam Explained

Have you received an email claiming a document is waiting for your “electronic signature” on DocuSign? Maybe the subject line said you have a new document or contract to review and sign digitally.

While it may look legitimate, this “DocuSign” phishing scam aims to steal your login credentials and personal information.

In this comprehensive guide, we’ll explain everything you need to know about the “Message Sent Using DocuSign Service” email phishing scam.

Overview of the DocuSign Phishing Scam

The “Message Sent Using DocuSign Service” is a crafty phishing scam that pretends to be from the legit electronic signature company, DocuSign.

Phishing scams use email or websites masked as trustworthy entities to trick users into giving up sensitive data like passwords and credit card numbers.

This DocuSign scam email looks convincing since it uses corporate branding and a professional format. The subject line normally says something like:

• (1 New) DocuSign Electronic Signature
• Urgent: DocuSign Document Ready for Signature
• Contract Update: DocuSign Account Action Required

Here’s an example of what the scam email body says:

This message was sent to you using the DocuSign Service.

Do Not Share This Email
This email contains a secure link to DocuSign. Please do not share this email, link, or access code with others.

REVIEW DOCUMENTS

Download the DocuSign App

This message was sent to you using the DocuSign Electronic Signature Service.

The email tries to create a sense of urgency and importance around “reviewing documents” on DocuSign.

Some even threaten account suspension if you don’t log in, which scares victims into acting rashly.

If you click on the “REVIEW DOCUMENTS” or “CONTINUE” button, you’ll be taken to a fake DocuSign login page hosted on a phishing site.

When you enter your email and password here, the scammers capture your credentials. The phishing site looks identical to the real DocuSign site to trick you into entering details.

From here, the attackers gain access to your account and can:

• Access private documents and files in your email
• Send more phishing emails to your contacts
• Access bank accounts, credit cards, or other financial platforms if you reuse passwords
• Steal your identity or commit fraud using your credentials

This scam is often used to distribute malware that can lock you out of your device and files.

Next, we’ll explore exactly how the DocuSign phishing scam works to lure victims in and steal sensitive information.

How the DocuSign “Electronic Signature” Phishing Scam Works

The DocuSign phishing scam is intricately designed to manipulate users into handing over login credentials and personal data.

Here’s a step-by-step walkthrough of how the fraudsters operate:

1. You Receive an Email Claiming to be From DocuSign

You’ll get an email using corporate DocuSign branding and logos in the header. The sender email is spoofed to look like it’s from @docusign.com.

As covered earlier, the subject line normally says something like:

• (1) New DocuSign Signature Request
• Action Required: DocuSign Account Review
• Urgent: Contract Document Requires Signature

This gives the impression there’s an urgent document that needs your digital signature on the real DocuSign platform.

2. Scam Email Body Urges You to “Review” or “Sign” Documents

The body copy reinforces the urgency around signing into your DocuSign account. Here’s some typical wording:

This message was sent to you using the DocuSign Electronic Signature Service. Please login to review and sign your documents.

Per our records, you have 1 new document requiring your immediate attention. Sign in to your DocuSign account to review and electronically sign these documents.

Urgent Notice: Your DocuSign account needs attention. Login now to avoid any interruption in service.

The bold call-to-actions like “Sign in” or “Review Documents” add legitimacy so you’re more likely click without thinking.

3. “DocuSign” Button Links to a Fake Phishing Login Page

When you click buttons like “CONTINUE,” “REVIEW DOCUMENTS,” or “SIGN IN,” you’re taken to a phishing site instead of the real DocuSign site.

The URL often looks convincing with intense random strings like:

https://docusign-update-xkt581CCxV1.signinforme0897823.nxrmal32.com 

The site is designed to precisely mimic the real DocuSign login page, down to the graphics, branding, and web design. This fools victims into believing it’s the legitimate site.

![Fake DocuSign Login Page][]

4. You Attempt to Login With Your Email and Password

Without realizing you’re on a phishing site, you then enter your email address and password in the login fields. ![Entering login details on phishing site][]

You might assume this extra login step is just DocuSign taking precautions before the document review. But in reality, you’re giving your credentials directly to scammers.

5. Attackers Steal Your Email Login and Other Personal Information

Once submitted, your email address and password are captured by the phishing site and attackers. They now have direct access to your email account.

From here, the scammers can:

• Access private documents and files stored in your email inbox
• Impersonate you by sending emails from your account
• Access connected accounts if you reuse passwords
• Access financial platforms or bank accounts linked to that email
• Steal your identity, commit fraud, or sell your information

The scammers can also distribute malware, trigger downloads to lock you out of your device, or hold your computer hostage for ransom.

Some phishing sites will ask for more personal information beyond your email and password, such as:

• Full name
• Phone number
• Home address
• Credit card number
• Driver’s license details

With this information, criminals can easily steal identities, commit financial fraud, or sell data to other parties.

What To Do If You Fell For the DocuSign Email Scam

If you submitted your details on the phishing site, here are important steps to take right away:

1. Change Your Email Password and Enable Two-Factor Authentication

As soon as possible, log into your legitimate email account and change your password. Make sure it’s unique and complex.

Also set up two-factor authentication using an authenticator app or mobile number for an extra layer of security.

This prevents the scammers from accessing your email with an old password.

2. Scan Your Computer for Malware, Adware, and Viruses

The phishing site may have downloaded malware or viruses onto your device. Scan your computer with Malwarebytes to detect and remove anything suspicious.

Also check browser extensions and remove anything you don’t remember installing.

3. Contact Banks, Financial Accounts, Employers, etc

If you reuse passwords across accounts, start changing them immediately.

Notify your bank, credit card companies, employer, or anywhere sensitive if the compromised email is associated with them.

Monitor statements closely for fraudulent activity. Consider freezing credit reports to be safe.

4. Beware of Any Emails From Your Compromised Account

Attackers may now send emails from your account to personal contacts or colleagues containing more phishing links or malware attachments.

Warn them not to open anything from your email. Send test emails from a different account if needed.

5. Watch For Identity Theft and Fraud

Keep an eye out for any suspicious activity indicating stolen identity, such as:

• Credit cards or accounts opened in your name
• Debt collection calls for accounts you don’t own
• Medical bills for treatment you didn’t receive
• Payroll/tax issues indicating job changes you didn’t make

Place fraud alerts and monitor your credit reports as precautions.

Is Your Device Infected? Check for Malware

If your device is running slowly or acting suspicious, it may be infected with malware. Malwarebytes Anti-Malware Free is a great option for scanning your device and detecting potential malware or viruses. The free version can efficiently check for and remove many common infections.  

Malwarebytes can run on Windows, Mac, and Android devices. Depending on which operating system is installed on the device you’re trying to run a Malwarebytes scan, please click on the tab below and follow the displayed steps.

Tips to Avoid Falling For the DocuSign Phishing Scam

Here are some tips to avoid becoming a victim of the “DocuSign email” scam going forward:

Look for Red Flags in the Sender Details

Carefully inspect the sender’s email address and name. Phishing emails may show:

• Misspellings (docusign.co instead of .com)
• Odd domains and addresses
• Reply-to addresses from free email providers

Unofficial addresses like support@docusigndocuments.com should raise alarms.

Verify the Login URL

Before entering any information, double check that the URL matches DocuSign exactly:

• https://www.docusign.com/
• Official URL starts with docusign.com

Scrutinize any redirection links carefully. Unusual or excessively long URLs are red flags.

Look for Poor Grammar, Spelling, and Formatting

Phishing emails tend to contain typos, awkward phrasing, and other linguistic mistakes. Notice if:

• Words are misspelled
• Sentences sound unnatural
• Branding/graphics look off

Official DocuSign emails will be professionally polished without errors.

Don’t Click Links in Unexpected Emails

Avoid clicking on any embedded links if you receive a surprise DocuSign email out of the blue. Even if it looks legitimate, manually navigate to the site to log in.

Verify the email first by contacting the alleged sender directly.

Use Caution When Asked to Verify Personal Information

DocuSign will rarely ask you to enter personal details like credit cards or government ID numbers to access documents.

Any urgent demands for sensitive information through email could be a scam attempt. Proceed with extreme caution.

DocuSign Emails Must Be Digitally Signed

Legitimate DocuSign emails contain visible digital signatures with “Signed by DocuSign” wording. Phishing emails lack this signature stamp of authenticity.

![DocuSign Digital Signature][]

Enable Login Notifications

Turn on DocuSign login notifications so you’re alerted whenever someone accesses your account. This lets you catch unauthorized logins immediately.

Frequently Asked Questions About the DocuSign Phishing Scam

1. How can I tell if a DocuSign email is legitimate or a scam?

Carefully inspect the sender’s email address and name for inaccuracies. Phishing emails often contain misspellings, odd domains, or reply-to addresses from free providers. Verify the URL matches DocuSign’s official site docusign.com and check for digital signatures on all DocuSign emails.

2. What happens if I click the link in a DocuSign phishing email?

The links in scam DocuSign emails redirect to a fake login page designed to steal your credentials. If you enter any login details, attackers gain full access to your accounts.

3. What should I do if I entered my login information on a DocuSign phishing site?

Immediately change your password and enable two-factor authentication. Scan devices for malware, monitor accounts for fraud, and beware of additional phishing attempts from your compromised email.

4. How can I avoid falling for the DocuSign email phishing scam?

Carefully verify sender addresses, URLs, and content in any emails asking you to login. Manually navigate to docusign.com to enter credentials. Enable login notifications and use unique passwords to minimize risk.

5. Why do phishing scammers target DocuSign users?

DocuSign’s popularity for e-signatures makes it a prime target. Scammers bank on users having sensitive documents, payment info, and other valuable data in accounts they can access.

6. Can phishing scammers really replicate the DocuSign login page and emails?

Yes, phishing sites and emails are designed to precisely mimic the DocuSign branding, graphics, and content. This fools victims into believing they are on the legitimate website.

7. Is it ever truly safe to click links or download attachments from emails?

No, it is never guaranteed safe. Always manually navigate to sites and verify senders before clicking email links or attachments, no matter how legitimate they appear.

8. How can I report a suspected DocuSign phishing email?

Forward scam emails to spam@docusign.com. You can also report phishing sites to Google Safe Browsing and the Anti-Phishing Working Group.

9. What information do DocuSign phishing scams aim to steal from users?

These scams mainly target email login credentials to access other accounts. But they can also steal names, addresses, credit cards, files, and any other sensitive personal data.

10. Could my device get hacked by clicking on links in a phishing email?

Yes, phishing sites often contain malware payloads that install on devices when clicked, allowing remote access for attackers to steal data and spy.

The Bottom Line

The “DocuSign email” phishing scam tricks countless people into surrendering email passwords and personal information daily.

These fraudulent emails pose as DocuSign, claiming you need to urgently sign or review a document. Buttons redirect to a fake login page designed to steal credentials.

If you receive a suspicious DocuSign email, carefully inspect the sender details, URLs, and content for red flags. Avoid blindly clicking on links or submitting sensitive information.

Change passwords and enable two-factor authentication if you shared details through a phishing site. Monitor accounts closely for fraudulent activity and be wary of follow-up phishing attempts.

Staying vigilant is key to protecting yourself from this scam. Arm yourself with knowledge of common phishing techniques used in the deceptive “DocuSign email” scheme and others like it.