Stay Sharp with Document Signing Requests

Digital document signing platforms like Docusign, Adobe Sign, and Dropbox Sign make it easy to approve campus forms, contracts, and agreements securely. Unfortunately, cybercriminals have learned to mimic these legitimate services to trick users into revealing personal information, university credentials, or payment data.

The Threat: Phishing Through “Sign This Document” Emails

Phishing attackers often send fake document signing requests that look strikingly real – complete with university logos, familiar sender names, or “urgent” subjects like:

• Action Required: Your Document is Ready for Signature
• Your Initial Deposit was processed. Review Below
• Faculty Contract Update

These messages may contain links to convincing look-alike websites where you’re prompted to “sign in” with your university or personal email credentials. Once entered, your login details go straight to the attacker.

Spot the Signs of a Fake

Before clicking “Review Document”, pause and check:

• Sender’s Address: Is it from a legitimate service domain (i.e. @docusign.com, @adobesign.com) – not a random or misspelled email address? Does the sender information match the person’s identity?
• Unexpected Request: Were you actually expecting a document from this person or department?
• Link Preview: Hover over the button or link – does it lead to the official site or an unfamiliar web address?
• Generic Language: Real university requests often include specific details (department name, contact information, context). Phishing messages tend to be vague.

What to Do if You Receive One

• Don’t click the link.

1. Report it immediately using the Phish Alert Button (PAB).
2. Verify directly with the sender through a separate, known communication channel.

If You Already Clicked or Entered Credentials

• Change your password right away – especially if it’s your Montclair login.
• Report the incident to the IT Service Desk or by using the PAB.
• Enable Multi-Factor Authentication (MFA) on all of your accounts; Duo can be used for your personal accounts too!

Stay Informed

Cybercriminals constantly adapt their tactics. Staying skeptical of unexpected document requests – even when they look official – is one of the simplest and most effective ways to protect yourself and the campus network.

Remember: When in double, report before you sign. 

“Before you click ‘Sign,’ make sure you’re not autographing a phishing scam. We’d hate for your biggest signature of the year to go to a hacker.”

— Emily Harris
Chief Information Security Officer

Want to Learn More?

BitDefender | Signing Contracts with DocuSign? Watch Out for These Phishing Scams

WeLiveSecurity | Word to the wise: Beware of fake Docusign emails

Infosecurity Magazine | Surge in DocuSign Phishing Attacks Target US State Contractors

Kaspersky | Phishing emails and Docusign electronic signature