DocuSign^®

SB

Sarah Bennett sent you a document to review and sign.
sarah.bennett-hr@outlook.com · 2 min ago

Q1 Compensation Adjustment — Confidential

Hi,

Please review and sign the attached document regarding your Q1 compensation review. This is time-sensitive — HR needs your signature before end of day today so Finance can process the adjustment in this pay cycle.

📄

Q1_Comp_Adjustment_YOU.pdf
1 page · awaiting your signature

Powered by DocuSign®. Secure electronic signature service.

🎣

Gotcha! This is a shared-document lure.

No credentials captured. Demo only.

What just happened?

DocuSign, SharePoint, OneDrive and Google Docs lures are among the most effective phishing templates today. The victim sees a familiar brand, a "document waiting" for them, and curiosity + urgency does the rest. Clicking Review leads to a fake Microsoft/Google login page that harvests credentials — often followed by an MFA prompt proxy to capture tokens too.

Red flags:

Sender address is personal. HR doesn't email from sarah.bennett-hr@outlook.com.
Generic name on a "personal" document. "Q1_Comp_Adjustment_YOU.pdf" is a template.
"Confidential, end of day today". Urgency + secrecy discourages you from asking colleagues.
Real DocuSign emails link to docusign.net. Always hover before clicking.
Asks for your corporate password. DocuSign doesn't need your Microsoft 365 password.

What to do:

If unexpected, check with the supposed sender on Slack/Teams/phone before clicking.
Hover every link. Real brands use their own domain.
Don't enter credentials on a page you reached from a link. Go to the service directly.
If you entered credentials: change password, revoke sessions, notify IT.

Back to safety

Q1 Compensation Adjustment — Confidential

Sign in to view this document

Gotcha! This is a shared-document lure.

What just happened?

Red flags:

What to do: