Is that DocuSign email real? Four checks, none of which is clicking the button

Drop your document here and sign it now. PDF, Word and Excel all work: a .docx or .xlsx is laid out in your browser exactly as it was written, so there is nothing to convert first. Add a signature, a date, a company stamp or a watermark, then download it sealed. Free to start, no account, and the file is never uploaded to do it.

The fake DocuSign notification is the most reproduced phishing email on the internet, and the reason is uncomfortable: it is the one message that trains people to click without thinking. Somebody sends you a contract, you are expecting a contract, the button says Review Document, and the whole point of the product is that you press it. Here are four checks that take less than a minute, in the order that catches the most fakes soonest. This is general information about spotting a forgery, not legal or security advice for your specific situation, and if money is about to move, confirm with the sender on a number you already had.

Check one: where the link actually goes

Hover the button on a computer, or press and hold it on a phone, and read the address that appears without opening it. A genuine DocuSign email sends you to docusign.net, and DocuSign's own site is docusign.com. Anything else is a fake, including addresses that contain the word docusign somewhere in the middle, like docusign.secure-review.example or docusign-login.example.

The trick nearly every fake uses is putting the trusted word on the left of the real domain, because that is where the eye stops reading. The only part that decides where you go is the last two labels before the first slash. Read those and ignore everything else in the address.

If you are already on a page asking for a docusign login with email and password, and you arrived there by clicking a link in an email, stop. Close it. Nothing you were sent is urgent enough to be worth typing a password into a page you reached that way.

Check two: go the long way round

Every genuine DocuSign envelope carries a security code, usually a long alphanumeric string at the bottom of the email. Visit docusign.com by typing the address yourself rather than clicking anything, open the DocuSign Access Documents page, and paste that code in. If the envelope is real it opens. If it is not, nothing does.

This is the single most reliable check available to a normal person, and almost nobody uses it. It works because it never touches the link you were sent. Make it the habit for anything involving money, property, payroll or a change of bank details, and the entire category of fake signing emails stops working on you.

The same principle applies to every tool including ours. Any document we produce carries a public verification page reached from our own domain, and you can check a file there without clicking anything anybody emailed you.

Check three: what the message is actually asking for

A real signing request asks you to sign a document. It does not ask you to enable macros, download an attachment to view it, install a viewer, confirm your Microsoft password, or update payment details. The same goes for a DocuSign Notary session, which is booked and joined from inside a real envelope rather than from a cold email. Those are the four asks that give a fake away, and they are asks the genuine product never makes because it does not need to.

Be most careful with the attachment version. Genuine DocuSign notifications link to a document held on their servers, they do not attach it. An email carrying a DocuSign logo and a .htm, .zip or .docm attachment is a fake with near certainty, and the attachment is the payload rather than the contract.

Also weigh the story. Fraud in this category almost always arrives with urgency and secrecy attached: sign before end of day, do not discuss it with accounts, the lawyer is unavailable. Genuine business is rarely damaged by a phone call.

Check four: the document itself, once you are safely in

Suppose the email is genuine and the document is not. This happens more than people expect: a real envelope, sent by a real account, containing an altered bank statement, a forged invoice or a payslip that was edited in a PDF editor. The signing platform is not checking the truth of the contents and does not claim to.

So look at the file. Fonts that change weight inside a single number, a figure whose alignment is a hair off the column, a total that does not equal the rows above it, metadata whose creation date is later than the statement period. Our verification tool will tell you whether a PDF has been edited after it was produced, and you can drop a suspicious file into it without sending it to anybody.

What none of this can do is prove the person behind the email is who they say. That takes a channel the sender did not choose: a number you already had, an address from a previous invoice, a colleague walking down the corridor.

When DocuSign is genuinely down

A DocuSign outage generates its own wave of fakes, because somebody who cannot open a document is somebody who will click the next link that promises to fix it. DocuSign publishes a real status page at status.docusign.com, reached by typing the address rather than following a link, and that is the only DocuSign status source worth reading during an outage.

If you are the sender and a deadline is real, the fastest workaround is not to wait. Download the document, sign it in a browser tool, and email the finished file with its verification link. The counterparty gets something they can check independently, which during an outage is worth more than an envelope they cannot open.

What we do about this, since it is the whole reason we exist

Every document signed here gets a public verification page. Anybody holding the file can open it and see that the document matches what was signed, who signed it, and when, without an account, a login, or a link that somebody emailed them. That is a deliberately different trust model from an envelope: the proof travels with the document rather than living inside the sender's account.

We also will not help anybody impersonate someone else. There is no way to backdate a signature here, no way to sign as a name you cannot receive mail for, and identity checks are available on the plans where they matter. Only ever sign as yourself, and only ever stamp a company you are authorised to act for. A tool that made forgery easy would be worth nothing to the people who need to prove a document is genuine.

If you have a document in front of you right now and you are not sure about it, drop it into the verifier rather than the signer. Checking costs nothing.

Questions people ask about this

How do I know if a DocuSign email is a scam?

Hover the button and read the last two labels of the address: genuine DocuSign links go to docusign.net or docusign.com and nothing else. Then ignore the link entirely, type docusign.com by hand, choose Access Documents and enter the security code printed in the email. A real envelope opens, a fake one does not.

Does DocuSign ever send documents as attachments?

No. Genuine notifications link to a document on their servers. An email with DocuSign branding and a .htm, .zip or .docm attachment is a phishing message with near certainty, and opening the attachment is the harm rather than the contract.

What does the real DocuSign login page look like?

It lives at account.docusign.com and you should reach it by typing the address, never by clicking an emailed link. If a page asks for your DocuSign login email and password and you arrived from an email, close it and start again from the address bar. Confirm with your IT team if you are unsure.

Is DocuSign down or is my link broken?

Check status.docusign.com by typing the address. During a genuine outage, fake "your document failed, click here" emails spike, so treat anything that arrives during one with extra suspicion.

The email is real but I think the document has been altered. What now?

The signing platform vouches for who signed and when, not for whether the contents are true. Drop the file into our verification tool to see whether the PDF was edited after it was produced, then confirm the details with the sender on a number you already had rather than one printed in the document.

Someone sent me a document to sign. Does it cost me anything?

No. Recipients never pay, at DocuSign, here, or anywhere serious in this category. If a signing page asks the signer for card details, that alone is enough reason to close it.

Make a signature free →

What PDF Verified is, and what it is not

These checks are a screen, not a verdict. A clean result means nothing was found by the checks that were run, which is not the same as proof that a document is genuine, and a flagged result can have an innocent explanation such as a re-save or a scan. Read the findings rather than the headline, and where a decision carries real consequences, confirm the document with the party that issued it. It is a tool for examining a document, not for producing a forged or altered one.

PDF Verified is a tool for preparing, signing, stamping and checking documents. It is not a law firm, a compliance service or a forensic examiner, and nothing here is legal, financial or compliance advice. Requirements differ by country, by document type and by the party asking, so check what applies to your document before you rely on it, and take advice where the document matters. You are responsible for the documents you create, sign and send, and for having the authority to do so: signing or stamping in somebody else name, or as an organisation you do not represent, is forgery whatever tool is used. To the extent the law allows, we accept no liability for how a document made with this tool is used or relied on. The full position is in our terms of service.

More on esignatures & signing

Tools