How to Avoid Phishing Scams

One of our top priorities is to make your DocuSign experience as safe and secure as possible — information security is in our DNA and ingrained in our people, processes, and technologies. In addition to delivering a secure experience, we can also provide tips to help anyone stay safe online. In this post, we look at the practice of phishing, how to avoid phishing attempts and how to identify DocuSign-themed phishing scams.

According to Proofpoint research, 74% of U.S. organizations experienced a successful phishing attack in 2020, resulting in loss of data, compromised accounts and credentials, ransomware/malware infections and even financial losses. Unfortunately, software as a service (SaaS) and branded webmail providers are among the most targeted brands for phishing attacks, with coronavirus-related and adjacent lures continuing to be the trickiest and  most-used themes.

The aim of these attacks is often to gain access to the victim’s email credentials. The tendency of most people to reuse usernames and passwords across websites, coupled with the trend of organizations using email addresses for user IDs, makes it easier for attackers to steal valuable information and exploit it. 

With the number of phishing attacks growing every day, it’s essential to stay ahead of these challenges. DocuSign is committed to employing the latest technology and industry knowledge to keep our customers safe from attackers—but it takes awareness and commitment from everyone involved to achieve the highest level of security. Learning how to recognize fraudulent emails is the best way to protect yourself and your data.

What is phishing?

Phishing is a technique used by attackers to trick individuals into divulging personal information—like login credentials—or launching malware to steal broader sets of data stored on their computers or connected networks.

A phishing email typically looks like a valid email from a trusted source, duping recipients into opening the email and clicking on enclosed attachments or links.

Other types of social engineering

Phishing is just one type of social engineering, the broad term used to describe various tactics and techniques used by attackers to psychologically manipulate and deceive individuals into divulging personal or confidential data. Bad actors will play on a potential victim’s emotions, using tactics that could include:

• Taking a false position of authority
• Exploiting one’s desire to help
• Playing on emotional needs or fears
• Offering something to win or obtain for free

Social engineering efforts usually appear harmless. They’re designed to exploit human nature and take advantage of everyday moments when victims aren’t expecting an attack. In addition to phishing, there are a variety of related social engineering tactics that you could be vulnerable to, all a variation on traditional phishing: 

• Spear phishing: focuses on specific targets within an organization
• Whaling: a type of spear phishing that targets senior executives
• Clone phishing: replicates and sends a previously delivered, legitimate email, but with a bad attachment or link
• CEO-fraud or business email compromise: a spear phishing attack that appears to come from the CEO or other senior leader, usually attempting to have funds transferred to a fake account
• Vhishing or vishing: attempts to get you to disclose information during a call with  either a live person or an interactive voice response (IVR) system or click a link or enter data after you receive an email related to the call
• Smishing: tries to get you to divulge private information by clicking a link or entering data in an sms/text message 
• Social media phishing: impersonates friends and other trusted resources on social media platforms, often successfully, in an attempt to get you to click on a link

Questions to ask yourself

Generally, it’s best to be skeptical about strange emails. Here’s a quick checklist of questions you can run through to ensure an email is legitimate: 

• Are you expecting the email?
• Do you recognize the sender?
• Do the email signature and the sender name/email address match?
• If it's a DocuSign email, does it have the new and correct logo and branding?
• Is the look or tone off from the norm?
• Are there spelling or grammar errors throughout?
• Is it more generic than it should be?
• Is it asking for you to provide your personal or login information?
• Are the links taking you to a valid and expected place (hover over them without clicking on your computer or long pause on your mobile device to see the link)?
• Are there strong emotions or an urgency communicated? 
• Do you feel like it’s just weird?

How to avoid being a victim of a phishing attempt

• Look for misspellings, poor grammar, generic greetings, a false sense of urgency and/or a demand
• Enable multi-factor authentication where possible
• Use strong, unique passwords for each service—don’t reuse passwords across multiple websites
• Ensure your antivirus software is up to date and all application patches are installed
• Contact the sender offline to verify the email’s authenticity if you’re suspicious

How to detect DocuSign-themed phishing attempts

A few simple techniques can help you spot the difference between a spoofed DocuSign email and the real thing:

• Don’t open unknown or suspicious attachments or click links—DocuSign will never ask you to open a PDF, office document or zip file in an email
• Hover over all embedded links—URLs to view or sign DocuSign documents contain “docusign.net/” and always start with https
• Access your documents directly from www.docusign.com by entering the unique security code, which is included at the bottom of every DocuSign email
• Report suspicious DocuSign-themed emails to your internal IT/security team and to spam@docusign.com

DocuSign proactively detects and deters phishing attempts by tapping into the deep expertise and experience of the DocuSign security team in combination with sophisticated automated techniques, including:

• Leveraging custom automation tooling (developed in conjunction with the DocuSign cybersecurity team) to process potentially fraudulent URLs submitted to spam@docusign.com by customers or reported in threat intelligence feeds
• Utilizing machine learning algorithms to improve accuracy and reduce false positives when identifying phishing attempts
• Using performance dashboards and visualizations to track phishing trends over time and analyze phishing pages in real time
• Enforcing a DMARC (Domain-based Message Authentication, Reporting and Conformance) reject policy on DocuSign.net, so any spoof email purportedly sent from docusign.net is rejected by all email providers supporting DMARC, after which the email content is sent to DocuSign for analysis
• Analyzing attackers’ actions and proactively detecting attacks by conducting forensic investigations and credential seeding
• Partnering with leading security vendors and law enforcement organizations to share, take down and add to allowlists any malicious websites and prevent further phishing attacks

For DocuSign security and system performance information, visit the DocuSign Trust Center.