Skip to Content
This DocuSign phishing scam could be sitting in your inbox
© Antonio Guillem | Dreamstime.com
Security & privacy

Watch out – This fake DocuSign site could steal your personal details

You don’t always need to sign a physical document these days. Instead, you can turn almost any document into a digital version and sign it electronically. Tap or click here for 15 important documents you need to digitize right now.

Digital signatures can replace pen-and-paper, and several companies provide it as a service. DocuSign is one of the largest, with over 1 million users in the U.S. and many more in over 180 countries.

But being the biggest also makes you a lucrative target. Read on to see why you need to be extra careful when you receive a DocuSign email that needs your attention.

Here’s the backstory

Sending documents back and forth for approval, signing, or review has never been easier. You don’t even need to attach the file to an email as it can be sent directly through digital signature software. Naturally, several processes are in place to ensure that the right person signs or it doesn’t get intercepted.

DocuSign
Credit: Armorblox

Unfortunately, some of those processes are no match for cybercriminals, as researchers at Armorblox discovered. Through sophisticated social engineering, criminals are trying to fool office workers into divulging personal information.

The attacks use fake DocuSign requests from spoofed email addresses to infiltrate corporate networks. The methods are relatively simple, sending out a request to a potential victim to review a document.

However, once the email is delivered, it could be hard to tell if it is authentic or not. The email is a near-perfect replica of DocuSign correspondence, with a link at the bottom to access the file.

“Upon clicking the link, the user is presented a preview of a DocuSign document overview. The similarity to a valid DocuSign overview landing page establishes a sense of trust within the recipient of this phishing attack,” Armorblox explained in a blog post.

But this is only half of the document, and the victim needs to click on “view completed document” to go further. Upon doing so, the criminals reap their rewards, as the victim is asked to enter their Microsoft credentials.

DocuSign
Credit: Armorblox

The scam is that the document is fake, and the criminals capture the details entered. As a result, they have full access to that account and use it to infiltrate other systems.

What you can do about it

This phishing scam can have dire consequences for any business and bring workflow procedures legitimacy into question. If you or your company use digital signature software, there are a few things that you must look out for:

  • Always verify that the email is from a real person in your company. Even if the email address seems authentic at first glance, scrutinize it for minor errors or typos. Reach out to the sender to verify it came from them before clicking links.
  • Where possible, enable two-factor authentication (2FA) to place another layer of security between you and criminals.
  • Be cautious with links and attachments found in unsolicited texts and emails. They could be part of phishing scams and lead to more problems.

Keep reading

Check your phone! Using one of these scam 2FA apps is a privacy disaster

Scammers have a clever new trick to steal money: Video chats

Ask me your digital question!

Navigating the digital world can be intimidating and sometimes downright daunting. Let me help! Reach out today to ask your digital question. You might even be on my show!

Ask Me