The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the Docusign email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake Docusign email hands you a document to open, with a file attached and a clock running.
Docusign’s page on spotting fraud lists the signs of a fake: a suspicious sender address, an attachment, and a generic greeting. The email below is invented, and each number is one of the signs.
Example
Dear Docusign Customer,
The Accounts Team sent you a document to sign: Payment Agreement 0000.
The document is attached as a PDF. Open it and enter your email password to view it.
This request expires in 24 hours.
The button says docusign.net/review
The sender's address is not at docusign.com or docusign.net.
Docusign says to check the “from” tab to be sure the email came from Docusign.com or Docusign.net, and to confirm an official domain like @docusign.net.
A generic greeting and a document you did not expect.
Docusign says many fake emails begin with a generic greeting like “Dear Docusign Customer.”
A PDF attached, and a password asked for.
Docusign says emails that request you to sign a document never contain attachments of any kind, and that it never sends signature requests as a file.
No security code, and a 24-hour deadline.
Docusign says to look for a unique security code in the email, which lets you reach the document from its official website. This email has none.
A button that says docusign.net and goes somewhere else.
Docusign says to hover over links to check that they lead to a legitimate domain before clicking.
From Docusign: How Docusign Users Can Spot, Avoid and Report Fraud, read 7 November 2026.
From Docusign: Safety center, read 7 November 2026.
Read the sender's address from the right, because the last two parts say who owns it.
Anyone can put “Docusign” in front of an address. The part to read is the domain, after the @. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. Docusign’s Safety center says to confirm that the sender’s email is from an official Docusign domain like @docusign.net, and the owner of that address is docusign.net.
Read the domain from the right
docusign.net
From DocusignOwned by docusign.net. Docusign names @docusign.net as an official domain.
docusign.net.view-document.example
Not from DocusignOwned by view-document.example. docusign.net is only a label in front of it.
docusign-documents-review.example
Not from DocusignOwned by docusign-documents-review.example. The name has Docusign in it, but the owner is someone else.
From Docusign: Safety center, read 7 November 2026.
Docusign says a real signing email has a security code and no attachment.
Docusign’s Safety center boils authenticity down to a few signs, and its blog adds more. A fake signing email tends to break each of them.
| Question | What Docusign says | What a fake Docusign email does |
|---|---|---|
| Who sent it? | What Docusign saysConfirm the sender's email is from an official Docusign domain like @docusign.net. The blog says to check that it came from Docusign.com or Docusign.net. | What a fake Docusign email doesIt comes from a look-alike domain with Docusign in the name. |
| Is a file attached? | What Docusign saysDocusign emails that request you to sign a document never contain attachments of any kind, and Docusign never sends signature requests as a file. | What a fake Docusign email doesA PDF to open, sometimes with a password to view it. |
| Is there a security code? | What Docusign saysA real email carries a unique security code, which lets you access the document directly from the official website instead of clicking a link. | What a fake Docusign email doesNo code, only a button. |
| How does it greet you? | What Docusign saysMany fake emails begin with a generic greeting like “Dear Docusign Customer.” | What a fake Docusign email does“Dear Docusign Customer,” or no name at all. |
From Docusign: Safety center, read 7 November 2026.
From Docusign: How Docusign Users Can Spot, Avoid and Report Fraud, read 7 November 2026.
A fake can reach you as a look-alike email, a real envelope or a fake site.
Docusign says fraudsters have signed up for legitimate Docusign accounts and used its services to appear reputable when sending documents to victims. So the sender check is not the whole story. Docusign has a separate route for each of the three.
Three routes, three reports
- A look-alike email
It does not come from a Docusign domain.
Docusign says to forward the entire email as an attachment to verify@docusign.com and delete it.
- A real envelope
It comes from someone's genuine Docusign account.
Docusign says not to click any links, and to use Report Abuse or the Report This Email link at the bottom of the notification.
- A fake website
A page made to look like Docusign.
Docusign says to copy the URL into an email to verify@docusign.com for investigation.
From Docusign Trust Center: Recognizing and Reporting Suspicious Activities, read 7 November 2026.
From Docusign: How Docusign Users Can Spot, Avoid and Report Fraud, read 7 November 2026.
Five steps tell you whether a Docusign email is real without clicking anything.
- Leave the button, every link and any attachment alone. Docusign says that if you receive a suspicious envelope, do not click any links.
- Read the sender’s address from the right, as in the picture above. If it is not a Docusign domain such as
docusign.netordocusign.com, do not trust it. - Look for the unique security code Docusign says real emails carry, which lets you reach the document from the official website. If the email has a file attached instead, Docusign says it never sends signature requests as a file.
- Paste the email into the checker at the top of this page for a second read.
- Forward the entire email as an attachment to
verify@docusign.com, then delete it. In Gmail you can also choose More next to Reply, then Report phishing.
From Docusign: Safety center, read 7 November 2026.
From Docusign Trust Center: Recognizing and Reporting Suspicious Activities, read 7 November 2026.
If you clicked or typed a password, the FTC lists the steps that match what you did.
Docusign’s pages cover how to report, not what to do after a click. The FTC’s phishing page covers a download, and its page for people who were scammed covers a password you gave away: create a new, strong password for the account, change it anywhere you reused it, and turn on two-factor authentication.
What to do depends on what you did
You only read it.
Forward it as an attachment to verify@docusign.com and delete it.
You clicked the link or opened an attachment.
Update your computer's security software, run a scan and remove what it finds.
You typed a password or card details.
Follow the FTC’s steps for what to do if you were scammed and the steps at IdentityTheft.gov.
From FTC Consumer Advice: What To Do if You Were Scammed, read 7 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 7 November 2026.
The same checks work on other account and billing emails.
A document to sign is one of the quickest ways to get a password. The guide to fake Microsoft sign-in emails covers an account alert, and the guide to fake PayPal invoice emails covers a bill with a number to call. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How can I tell a real Docusign email from a fake one?
Docusign says to confirm the sender's email is from an official Docusign domain like @docusign.net, and its blog says to check that the email came from Docusign.com or Docusign.net. It also says to look for a unique security code in the email, and to watch for a generic greeting like "Dear Docusign Customer".
Does Docusign send documents as attachments?
No. Docusign says its emails that request you to sign a document never contain attachments of any kind, and that it never sends signature requests as a file. An email that asks you to open an attached document to sign is the kind it warns about.
What is the security code in a Docusign email?
Docusign says to look for a unique security code in the email, which allows you to access the document directly from the official website instead of clicking a link. It also says to be wary of attachments, because Docusign never sends signature requests as a file.
Where do I report a fake Docusign email?
Docusign says to forward the entire email as an attachment to verify@docusign.com and delete it immediately. For a fake website, copy the URL into an email to verify@docusign.com. In Gmail you can also open the message, choose More next to Reply, then Report phishing.
Can a real Docusign envelope still be a scam?
Docusign says fraudsters have signed up for legitimate Docusign accounts and used its services to appear reputable when sending documents to victims. If you receive a suspicious envelope, it says not to click any links and to use the Report Abuse feature, or the Report This Email link at the bottom of the envelope email notification.
What should I do if I clicked a link or opened an attachment?
If something may have downloaded, the FTC says to update your computer's security software, run a scan and remove what it finds. For details you shared, such as an email password or card number, IdentityTheft.gov lists the steps that match what you lost.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.
- Docusign: Safety center
- Docusign: How Docusign Users Can Spot, Avoid and Report Fraud
- Docusign Trust Center: Recognizing and Reporting Suspicious Activities
- FTC Consumer Advice: What To Do if You Were Scammed
- FTC Consumer Advice: How To Recognize and Avoid Phishing Scams
- IdentityTheft.gov
- Gmail Help: Avoid & report phishing emails