If your email security has started tagging DocuSign emails as “medium risk”, don’t panic. You’re not alone, it’s happening to most of us.
DocuSign hasn’t suddenly become unsafe. What’s changed is how criminals use it. Trusted platforms are now one of their favourite ways to make phishing look legitimate.
Why the change?
For years we’ve told staff to be wary of unknown links and unexpected attachments. The attackers listened too. Rather than building fake websites from scratch, they now lean on real cloud services: e-signing tools, file sharing and collaboration platforms.
DocuSign is everywhere in business and people trust it, which makes it a very handy vehicle for a phishing campaign. Attackers will:
- send fake DocuSign notifications
- create fraudulent signature requests
- use compromised accounts to send real DocuSign envelopes
- hide malicious links inside documents or the emails around them
So security vendors have started giving DocuSign-related emails and links a closer look.
Is this new?
Not really. Abuse of trusted cloud platforms has been growing for several years. What’s newer is how security tools judge risk. They no longer just ask “is this a real website?” They also ask:
- Do attackers commonly abuse this kind of link?
- Is this sender expected?
- Does the request look like normal business?
- Is the person being asked to do something with payments, passwords or sensitive information?
That’s why a perfectly genuine DocuSign email can still get a medium-risk rating when the tool thinks a bit of extra caution is sensible.
Is it just DocuSign?
No. We’re seeing the same treatment for:
- Microsoft 365, OneDrive and SharePoint sharing links
- Dropbox and Box links
- Google Drive documents
- Adobe Acrobat Sign requests
The security industry has worked out that attackers use trusted services because people are more likely to click on them.
A warning doesn’t mean the document is dodgy. It’s a bit of a nuisance when you click a link and your security software pops up an alert, but I’d much rather that than the alternative.
What should you do?
Look at the context, not just the logo. A request from a trusted platform still deserves care if you weren’t expecting it. Our advice:
- Check the sender. If in doubt, pick up the phone (using a number you already have, not one in the email).
- Look before you click. Hover over links and check where they really go.
- Use modern email security. The warnings are a sign it’s working.
- Train your team regularly. Phishing changes all the time, and so should your training.
- Move to passkeys, or at least turn on MFA everywhere. A stolen password is far less useful when it isn’t enough to log in.
Want to know how well your email security and staff would cope with a convincing phishing email? Book a free health check, or call us on 0800 688 768.