Fake E-Signature Requests: The Phishing Email That Looks Like Paperwork

If you run a small business in Monterey County or anywhere else on the Central Coast, e-signature requests arrive all week: leases, contracts, quotes, change orders, vendor forms. Scammers know it, and a fake "please review and sign" email is now one of the easiest ways to steal an email login.

This guide explains how the scam works, how to spot it, and the habits that stop it.

1. How the fake e-signature scam works

The email looks like it came from a familiar signing service, or from a vendor or client you work with. It says a document is waiting and gives you a button to open it.

• The link goes to a fake login page. It asks you to sign in with Microsoft 365 or Google to "view the document." The page copies your password the moment you type it. This is the same trick behind fake login pop-ups.
• The sender may be real. Attackers often send from a hijacked account at a real company, so the message arrives in a thread you trust. That is how business email compromise spreads from one victim to the next.
• The file can be the trap. Some messages attach a PDF with a QR code or a button instead. See our notes on QR code phishing.
• The goal is your mailbox. Once inside, the attacker reads your mail, sets up a hidden forwarding rule, and sends the same scam to your contacts.

2. How to spot a fake signing request

The branding is easy to copy. The small details are harder.

• No context. You were not expecting a contract, or the document name is vague, such as "Invoice Agreement" or "Payment Review."
• A mismatch in the sender. The display name says one thing and the email address says another, or the domain is one letter off. Our guide to lookalike domains shows what to look for.
• A link that does not match. Hover over the button before you click. If the address is not the signing service you use, stop.
• Pressure. "Expires in 24 hours" and "final notice" push you to skip your usual checks.
• A request to sign in again. If you are already signed in to your work account, a page that asks for your password again deserves suspicion.

3. Habits that stop it

You do not need new software to cut this risk down. You need a few rules that everyone follows.

• Never sign in from an email link. Open the signing service from your own bookmark and look for the document there. If it is not in your account, it is not real.
• Call to confirm the unexpected. A 30-second call to a known number beats an hour of cleanup.
• Upgrade your sign-in. Use passkeys or security keys where you can, because they do not work on a fake page. Standard multi-factor authentication is still worth having everywhere.
• Use a password manager. A password manager will not auto-fill on a site it does not recognize, which is a useful warning.
• Practice. Include a fake signing request in your next phishing drill, and know what to do if someone clicks a phishing link.

The takeaway

Fake e-signature emails work because they look like normal work. Treat every unexpected signing request as unverified until you have opened the service yourself or made a call. If you want help tightening email and sign-in protection, see our cybersecurity and managed IT services, or check current pricing.

Frequently asked questions

What is a fake e-signature phishing email?

An email that imitates an e-signature service and says a document is waiting for you to review and sign. The link leads to a fake login page that steals your Microsoft 365 or Google password, or to a file that installs malware.

How can I tell if a DocuSign-style email is real?

Do not use the link in the email. Open the e-signature service in your browser yourself, or ask the sender by phone whether they sent a document. Real requests also show up in your account, and you can confirm the sender and the document name there.

What should I do if I entered my password on a fake signing page?

Change that password right away from a different device, sign out of all sessions, and tell your IT provider. Check the mailbox for new forwarding rules and unfamiliar sign-ins, and reset multi-factor authentication if it was changed.

Why do scammers use e-signature emails?

Signing documents is routine in real estate, construction, insurance, and professional services, so people click without thinking. Attackers also send these from a hijacked account at a real company, which makes the email pass basic checks.

Can multi-factor authentication stop this scam?

It blocks a stolen password on its own, but attackers can capture codes on a fake page in real time. Phishing-resistant sign-in such as passkeys or security keys is stronger, and the call-back habit still matters.

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.