Spot Fake Document-Signing Requests
Check document-signing requests through independent channels. Spot impersonation, verify the sender and respond safely if you clicked a suspicious link.
On this page (13 sections)▼
A document-signing email is not safe merely because it carries a familiar logo or arrives through a real signing service. Verify the business request independently, access the service through a known official route and review what the document asks you to do before signing.
This is particularly important when the request changes payment details, seeks credentials or asks for an unexpected agreement. A genuine platform notification can still concern a deceptive transaction. The checks below separate three questions: is the message authentic, is the requester authorized, and is the document itself something you should approve?
Pause before opening an unexpected signing request
Start with the business context. Were you expecting this agreement, from this person, at this stage? A request labeled urgent is not a substitute for a recognized transaction. Do not let an imminent expiry message turn a missing context check into an automatic click.
Read the sender display name and address, subject and summary, but treat them as clues rather than proof. A familiar colleague's name can be copied. A real email account can be compromised. Good spelling and a professional logo do not establish authority.
If you are not the expected signatory, do not forward the request widely asking who wants it. That can distribute a deceptive link to more people. Contact the transaction owner through the organization's known directory or previous verified conversation. Ask them to identify the agreement and the signer role before you proceed.
If the invitation arrives outside the usual process, note that difference explicitly. A colleague can then evaluate the same facts instead of relying on your intuition. Keep the review calm: an unexpected request deserves verification, while an unexpected request alone is not proof that the sender has committed fraud.
Separate message authenticity from transaction legitimacy
| Question | Example of useful evidence | What it cannot prove alone |
|---|---|---|
| Is the message from the platform? | Official verification route | Sender is authorized for your transaction |
| Did the requester send it? | Independent known-contact confirmation | Contract terms are acceptable |
| Is the signer correct? | Existing approval workflow | Contents are accurate |
| Is the document expected? | Reference to agreed business matter | Every attachment is safe |
| Should it be signed now? | Owner and counsel approval when needed | Technical origin authenticity |
This layered approach avoids a common mistake: treating platform delivery as business approval. A service can transmit a document without deciding whether the underlying transaction is legitimate for you.
Avoid creating a universal allowlist from a short list of sender addresses found in an old article. Platform delivery domains and configurations can change, and superficial address matching can miss other risks. Consult the service's current official guidance and use your own security team's controls.
Use a known official access route
For Docusign, its safety guidance describes independent access and reporting options, including its Access Documents flow. Docusign safety alerts and independent document access Navigate using a trusted bookmark or a domain you type yourself, rather than the questionable message's button.
Where the official workflow supports a security code, use it only through the genuine service page. Do not enter the code into a site reached from a suspicious redirect. A code helps locate a request; it does not resolve whether the business purpose is appropriate.
For another signing provider, look up its equivalent verification instructions on that provider's official site. Do not assume Docusign's exact controls exist everywhere. If you cannot verify the service or cannot find a known transaction, contact the sender independently and request a clean resend through the agreed process. Do not upload confidential agreements to an unknown “email checker” to authenticate them.
Watch for requests that move you outside the signing workflow
A signing invitation should not persuade you to reveal unrelated account credentials, recovery codes or banking secrets. Be cautious if an agreement directs you to another site to “activate access” or install software before viewing ordinary terms.
Look for unexpected changes in purpose. A routine supplier renewal that suddenly asks for a deposit to a new account deserves a separate payment verification. A supposed HR acknowledgement that asks you to sign away rights is not merely a technical email check. Involve the responsible owner or counsel as appropriate.
Do not download an attachment simply because its filename contains agreement or invoice. Check the actual workflow and ask your security team to handle suspicious files. Your task is to validate a legitimate signing request, not to investigate malicious attachments by opening them on your everyday device.
Confirm the sender through an independent channel
Use a phone number or contact route from an existing trusted record, not the contact details supplied in the suspicious message. Ask a simple question: “Did you send agreement reference X for me to sign, and what is it for?”
Do not reveal passwords or verification codes during that conversation. If the person cannot identify the document, pause. If their mailbox appears compromised, ask the organization for another known contact or follow your internal incident route.
A reply in the same email thread can be insufficient when that account is part of the concern. Independence means a meaningful change in trust source, not merely switching from a button to replying. Record the person's confirmation and any corrected reference in the transaction file. This helps another reviewer understand why the request was accepted or rejected without collecting unnecessary sensitive details.
A fictional supplier renewal example
Consider a fictional finance manager who receives an unexpected signing invitation from a supplier's apparent account. The platform page is genuine, and the document resembles last year's contract, but an appendix changes the destination bank account.
The manager does not sign immediately. They contact the supplier using the number in the existing vendor record. The known contact confirms that a renewal is expected but says the banking appendix was not authorized. The manager sends the evidence to their own security and procurement teams and pauses the transaction.
This example shows why the genuine platform check is only one step. The manager never needs to claim the signing service itself was hacked. The suspicious document may have been created through an otherwise legitimate account. The immediate decision is to withhold approval and verify the request, while specialists determine the cause.
Inspect the actual agreement before approval
When the request is verified, review the content using the ordinary approval process. Check counterparties, attachments, obligations, signatory identity, effective dates and any financial instructions. Technical verification does not replace commercial or legal review.
Compare the document to the version previously approved if one exists. If a change is unexpected, ask the owner for a tracked explanation or another appropriate comparison. Do not assume the file named final is the approved final.
Check whether a signing request gives you all referenced schedules. An agreement can be authentic but incomplete. If your decision depends on a missing appendix, stop and request it through the verified channel. Preserve the appropriate final records after signing according to your organization's policy, rather than relying on a transient email link as the only evidence.
Respond based on what you already did
| Your action | Immediate next step | Important limitation |
|---|---|---|
| Only received message | Report or verify without clicking | Arrival alone does not prove compromise |
| Opened a link | Tell security the URL and timing | Do not infer safety from no visible error |
| Entered credentials | Use known account recovery route and alert IT | Password change may not end every session |
| Downloaded a file | Stop handling it and follow security instructions | Deletion alone may not address execution |
| Signed or paid | Contact owner, counsel or bank promptly | Reversibility depends on facts and process |
Give responders an accurate account of what occurred. “I clicked, but did not type a password” is more useful than “I think nothing happened.” Do not conceal the incident because the document looked ordinary. Fast factual reporting allows the right team to select proportionate containment.
Report suspicious requests without spreading them
Use the platform's current official reporting path and your employer's internal reporting control. Docusign's safety resources identify its verification contact. Docusign fraud resources Follow those instructions rather than sending the message to addresses copied from an unrelated forum.
Your organization may prefer forwarding the original as an attachment, using a reporting button or opening an incident ticket. Preserve useful context such as arrival time, document reference and what you clicked. Avoid distributing the file to a broad group for informal investigation.
If the agreement includes customer or employee information, limit report recipients to those who need it. A suspicious message is not permission to disclose confidential content publicly. Keep platform impersonation claims factual: describe what looked suspicious and what verification failed, rather than announcing a confirmed breach without evidence.
Make the next legitimate request easier to recognize
Agree on a signing process with regular counterparties. Tell recipients which service you use, who may send agreements and how they can verify an unexpected request. Do this before the high-pressure moment, not inside the first urgent notification.
For internal teams, document who owns the contract and who can approve changes. Keep vendor contact records current and independent of incoming payment instructions. A clear business workflow reduces the chance that employees will treat a polished notification as authority.
Repeat the same layered checks for renewals and amendments, not only new vendors. A familiar relationship can create complacency. The dependable habit is straightforward: establish the transaction, enter through a known service route, confirm the requester and review the actual agreement. If one piece does not fit, pause signing and resolve it through trusted contacts.
Frequently asked questions
Can a genuine signing-platform email still be used in a scam?
Yes. Platform authenticity does not prove that a sender is authorized or that a transaction is legitimate. Verify the business purpose independently.
Should I reply to the email to confirm it?
Use a known independent contact route when the mailbox itself may be compromised. A reply in the suspicious thread is not always independent verification.
What if I already signed a suspicious document?
Contact the responsible business owner and appropriate legal or security team promptly. Explain exactly what you signed; possible remedies depend on the circumstances.
Before you proceed
Verify the platform, the person and the agreement as separate questions. That gives you a clear reason to proceed and a clear point to stop when a signing request does not match the expected transaction.
Parent guide
Related articles
Sources and editorial disclosure
Primary documentation reviewed October 13, 2026. Worked examples are fictional illustrations. Checklists and decision frameworks are editorial recommendations; product-specific facts are linked to official documentation. These guides do not claim that signed-in product tests or customer projects were performed.
VDR Directory is published by the team behind SendNow. This ownership is relevant when evaluating any product mention. Stock photos illustrate general context; they do not demonstrate software features or identify actual affected people. Controls and tool availability depend on the provider, edition, version, device and configuration. No guide guarantees confidentiality, regulatory compliance, acceptance of altered documents, or search rankings.
Related Guides & Research
Recommended next reading for deal teams and transaction leaders.
Sent a Confidential Document to the Wrong Person?
Sent a private document to the wrong person? Contain further access, preserve facts, assess what was exposed, and coordinate the next response.
Are Deleted Documents Still in Provider Backups?
Understand what deletion means for provider backups, ask for useful evidence, and separate removed access from confirmed data removal.
Investigate Unexpected Document Downloads
Investigate unusual file downloads using a clear timeline, identity checks and preserved evidence, without treating every alert as a confirmed breach.