Before you sign, check it's genuine

Warning signs

Pressure and deadlines: "Sign within 24 hours or your account will be closed." Real organisations give you time and don't threaten you into signing.

Money or login details on the way: A signing page that asks for your email password, bank login, card number or a payment before you can see the document.

Sender that doesn't fit: A company name you know, but an address from a free email service or a domain with an extra word or a misspelling.

Vague or blurred document: "You have a document to review" with no details, or a blurred preview that you are told to click to unlock.

Generic greeting: "Dear customer" from an organisation that normally uses your name, or no mention of any reference you would recognise.

Unexpected attachment type: A "PDF" that is actually a web page, a zip file or a program. A real PDF's name ends in .pdf and opens as a document.

How to tell if a Docusign email is real

Docusign is one of the most copied names in fake signing emails. According to Docusign's own safety guidance, its real notifications come only from docusign.com or docusign.net addresses. Each genuine email also carries a security code at the bottom. Instead of clicking the button in the email, go to docusign.com yourself, use Access Documents and type in that code; if the document is real, it opens there. Suspicious messages can be forwarded as an attachment to verify@docusign.com.

The same idea works for any signing service: don't use the link in the email, go to the service or the sender directly and look for the document there. A real request will still be waiting for you.

Checking a PDF that came as an attachment

Look at the file name before opening it. It should end in .pdf; names like invoice.pdf.html or document.zip are not PDFs. Then open it and read it properly: whose name is at the top, which account or reference number does it mention, and does that match something you know about? Genuine letters from your bank, landlord or employer usually refer to details only they would have.

If the print is small, open the file in our free large-print reader, which shows just the text in big type and can read it aloud without sending the file anywhere. Reading slowly is the best defence against a document that says something different from what the email claimed.

Call them, using a number you already have

If a bank, energy supplier, insurer, council or government office sends you something to sign, find their number on an old letter, a bill, the back of your card or their official website, and call. Ask one simple question: did you send me this, and what is it for? It takes five minutes and settles it either way. A phone number printed in the suspicious email proves nothing, because the fraudster controls it.

A second pair of eyes helps too. Forward the email to a family member or friend you trust, or read it out to them on the phone before you do anything.

If you already clicked, entered details or signed

Don't panic, and act quickly. If you typed a password into a page reached from the email, change that password now, and anywhere else you used it. If you gave card or bank details, call your bank on the number on your card and ask them to block the card. If you signed a document you now doubt, contact the organisation named in it, through their official number, and explain what happened.

Then report it. In the United States, the Federal Trade Commission asks you to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and to report the attempt at ReportFraud.ftc.gov. In the United Kingdom, the National Cyber Security Centre accepts suspicious emails forwarded to report@phishing.gov.uk. Reporting helps get the fake sites taken down.

Sources (checked 29 September 2026)

• Docusign: safety alerts and how to verify its emails
• Docusign: fraud alert about fake blurred documents
• FTC: how to recognise, avoid and report phishing
• NCSC: report a scam email