Before you respond
Docusign email: real request or phishing?
An unexpected Docusign email can look like an ordinary signature request. Check who asked for the document and what it authorizes before opening a link or signing.
By Olevo ·
Quick answer
An unexpected Docusign email needs two checks: did the real person or company send this request, and is the document asking for something you intended to authorize? Contact the sender through details you already trust. Leave the email's links and attachments unused while you check.
A familiar logo or sender address cannot settle both questions. Docusign warns about spoofed notifications, and HHS has documented fraudulent invoices sent using legitimate Docusign accounts. A real delivery platform does not make every document or payment request legitimate.
Read the signature request before acting
Document awaiting signature: approve this invoice today to keep your service active. Review at [link removed].
- The message connects signing with an immediate service deadline.
- The invoice and the claimed consequence each need confirmation with the real provider.
- The request can be checked without opening its link or sharing the document's access code.
At a glance
A Docusign email scam uses a signature or document-review request to seek account access, a payment, or an authorization. Some messages imitate the platform; others misuse genuine accounts. Verifying delivery and verifying the underlying request are separate checks.
- The named sender cannot confirm the request through an existing contact route.
- An unexpected document authorizes a charge or changes payment details.
- The message pressures you to sign before checking the agreement.
Ask the real sender what document they sent and why, using a contact route outside the email.
Check the notification and the instruction separately
What you see
A Docusign logo and document reference
What remains unverified
Who requested the document
Independent check
Contact the person or company through your existing records
What you see
A message delivered through a real service
What remains unverified
Whether the document or invoice is authorized
Independent check
Compare it with the agreement and approval you expected
What you see
A signature request containing payment terms
What remains unverified
Whether signing creates an obligation you intended
Independent check
Ask the real counterparty or your organization's approver before signing
How to check whether a Docusign email is real
Start with the relationship behind the request. Were you expecting a tenancy agreement, employment document, or supplier invoice from this person? Ask them to confirm the document's purpose through a known number or an established conversation. Replying to the unexpected email keeps the check inside the same unverified route.
Docusign's spoofing alert explains that imitation emails can hide links to unrelated websites. Separately, the HHS alert describes abuse of genuine accounts to distribute fraudulent invoices. This is why a sender-domain check is useful evidence, but not permission to sign. The document's terms and the sender's authority still need checking.
When the document asks you to approve a payment
Read the requested action rather than treating the notification as a routine delivery receipt. Does the document approve an invoice, name a new recipient, or change bank details? Match those details to your own records. An invoice number in the email is a claim to compare, not a record from your bank.
At work, follow the normal approval process for new suppliers, invoices, and changed payment details. A request arriving through an e-signature platform should not skip those checks. For a personal document, ask the real sender for an explanation through a contact route you already have before accepting unfamiliar terms.
If you already clicked, entered a password, or signed
Write down which action happened. Only opening a page, entering a password, signing a document, and sending money create different concerns. If you entered credentials, use the real service's account-recovery process and change reused passwords. If a work account is involved, tell your IT or security team through its normal channel.
If you signed an unexpected document, contact the real counterparty and Docusign support independently and preserve the notification and document reference. Do not assume that deleting the email cancels the signature. If money moved, contact your bank or payment provider promptly. A message review cannot establish the legal effect of a signature or reverse a payment.
Signs to slow down
- You were not expecting a document from this sender.
- An invoice or payment authorization is hidden inside a routine-looking request.
- Someone asks you to forward a document access code or login link.
What to do next
- Keep the unexpected link, attachment, and access code unused.
- Confirm the specific document with the real sender independently.
- Compare payment details and approvals with your own records.
- Secure any account whose credentials you entered, and contact your provider about payments already made.
How to report it
- Use the reporting instructions on Docusign's official Trust Center, reached independently.
- For a work message, report it through your organization's security process.
- In the US, report fraud at ReportFraud.ftc.gov and contact the affected provider about account or payment exposure.
How Olevo can help
Olevo can help you read the wording of a signature request and identify what needs independent checking.
Remove names, contract details, access codes, login links, signatures, and account information first. Olevo cannot open an envelope or attachment, authenticate a sender, assess a contract's legal effect, or cancel a signature.
Trusted sources
Spoofed Docusign email warning
Docusign
June 2025 warning about imitation document notifications. Checked October 25, 2026; this is background guidance, not a new incident report.
E-signature platforms used for fraudulent invoices
US Department of Health and Human Services / HC3
November 19, 2024 sector alert. Distinguishes spoofed emails from abuse of legitimate Docusign accounts; it does not authenticate any individual request.
Recognizing and avoiding phishing
Federal Trade Commission
Independent contact checks and steps after exposing account or payment information.
Common questions
Can a Docusign email be fraudulent even if it came through the real service?
Yes. HHS documented fraudulent invoices distributed using legitimate Docusign accounts. The delivery service and the underlying request need separate checks. Confirm the specific document with the real sender through contact details outside the email, and use your normal approval process before signing or paying.
Why did I receive a Docusign email when I was not expecting a document?
The message alone cannot establish why it was sent or who controls the request. It could be a mistake, an imitation, or an unwanted request through a real account. Contact the named sender independently before opening links, entering credentials, or signing anything.
Can Olevo open the document and tell me whether to sign?
Olevo reviews the text or redacted image you choose to provide. It does not open document links or attachments, verify the sender, or decide whether a contract should be signed. Use the real counterparty and appropriate professional help for the document itself.