Is this DocuSign email real or a phishing scam?

Use the security code to reach the envelope from DocuSign.

Real DocuSign signing emails include a security code that lets you access the envelope without trusting the email button. Many fakes skip it, shorten it into a fake envelope ID, or put a code only on the phishing page because there is no real DocuSign envelope behind the message.

Reject any notice that turns signing into a Microsoft 365 or Gmail login.

The scam needs your mailbox password, not your signature. Once it has that password, the next move is usually inbox access, invoice-thread theft, and payment-change messages sent from your real account.

Treat a PDF with a QR code as outside the DocuSign flow.

The fake attachment usually says mobile review is required or the document is protected. That moves you from a monitored work browser to a phone camera and a phone browser, where the fake Microsoft or Google login screen gets fewer security checks.

Require a DocuSign notification domain, not a DocuSign-looking word.

A sender like notifications@docusign-secure.net is built to win the first glance, but the root domain is docusign-secure.net, not DocuSign. Real DocuSign notification mail is tied to DocuSign domains such as docusign.net or docusign.com, not a hyphenated copycat sitting after the @ sign.

Reject an email that says completed and still demands your signature.

That wording conflict shows the sender is copying DocuSign language without understanding the envelope state. A completed envelope is not the same event as a new envelope waiting for your signature, and scammers mix the terms because one template gets reused for AP, HR, legal, and payroll lures.

Refuse attachments that replace the envelope.

A DocuSign signing notice should send you into an envelope review, not make you open Q4 Vendor Remittance Authorization.pdf to begin. The attachment version gives the attacker a place for a QR code, a fake button, or a malware prompt while still borrowing DocuSign trust from the email subject line.

Do not use an access page that asks for your email password first.

Some fake pages copy DocuSign colors, then put Microsoft 365, Gmail, or company email buttons in the center. That is the payload. The attacker wants a reusable login, not a one-time signature decision inside an envelope.

Do not clear a DocuSign notice just because SPF, DKIM, or DMARC passed.

Attackers can abuse a real DocuSign account, a compromised sender, or an API path, so email authentication may only prove the message came through an allowed channel. It does not prove the business request, the signer, or the destination page is safe.

Open docusign.com and use the security code from the email.

Use DocuSign’s own access path instead of the Review Document button. If the message has no usable security code, that is evidence by itself, because the email is asking you to trust a link while withholding the DocuSign detail that lets you bypass it.

Forward the suspicious email to spam@docusign.com.

Send the original message, not a screenshot, so DocuSign can see the sender, links, and attachment behavior. This is DocuSign’s published reporting route for suspicious DocuSign-branded email.

Ask the named sender to void and resend the envelope inside DocuSign.

Do not ask them to explain the old email thread. A clean resend creates a fresh envelope, fresh notification, and fresh security code, which breaks the attacker’s copied link, QR page, or abused template.

If you scanned the QR code, send IT the PDF and the phone URL.

The phone visit is part of the evidence because the QR page may differ from the desktop link. Include the time you scanned it and whether it asked for Microsoft 365, Gmail, a download, or a browser permission.

If you typed a Microsoft 365 or Google password, revoke sessions now.

Change the password from the real account portal, then have IT remove active sessions, new MFA methods, mail forwarding rules, inbox delegates, and suspicious sign-in tokens. The danger is not the DocuSign email anymore. It is the mailbox the attacker may already be using.

If you clicked a fake DocuSign page, capture the URL before closing it.

Do not keep interacting with the page, download the offered file, or approve a browser prompt. The exact URL helps IT block the phishing host and check whether the page only collected visits or tried to push a file.

If you signed, pull the Certificate of Completion and freeze the workflow.

DocuSign’s certificate shows envelope details such as recipients, timing, and audit events, which helps separate a real envelope from a copied lure. Stop any invoice, payroll, vendor, or contract action tied to that envelope until the sender voids or confirms it from inside DocuSign.