DocuSign "document to review and sign" phishing
An email that looks like a DocuSign envelope notification with a "Review document" button. The button leads to a login page that steals the email password, or to a file download. DocuSign asks for copies at spam@docusign.com.
- Impersonates
- DocuSign
- Arrives by
- First seen
- not dated
- Specimens
- 0
- Updated
- 2026-09-02
Right now what this family looks like
How to recognise it
- A document you were not expecting from a sender you do not know
- The button asks you to sign in to your email provider first
- Real DocuSign emails carry a security code and open on docusign.com
What to do
- Do not click; if you expect a document, open docusign.com and use the security code from the email there
- Forward it to spam@docusign.com
- Delete it
Already called, clicked or paid? what to do in the next hour
- Entered a password? Change it now, and everywhere else you used the same one
- Entered card details? Call your bank, ask them to block the card and reissue
- Entered a one-time code? Sign in to the real service now and check for changes to email, phone and payment settings
How it changed
nothing to compare yet · no specimen on recordGot a version? A new subject line, sender, number or domain becomes the next point on this line. Redacted before publication. Send it →
02 Sept2026
Registry
Family created
Opened at launch from the pattern DocuSign documents; no dated specimen on record yet — send yours.
Same trick, other brands
- Supplier "updated bank details" (invoice redirect)active · 2026-09
Indicators
- None on record yet. Indicators change weekly; an empty list never means an email is safe.
In other streams
- Nothing yet.
Registry data
- Machine-readable
/scams/docusign-document-waiting.json- Timeline feed
/scams/docusign-document-waiting/feed.xml- Sources
- 1 · 1 change logged
- Licence
- CC BY 4.0 · attribution required
- Created / updated
- 2026-09-02 / 2026-09-02