Staying safe when you sign online

You don't need to be a security expert to sign safely — you need a short habit you run every time. Thirty seconds before, thirty seconds after, and a one-time account setup.

Before you click: is this request real?

Fake signing requests are a favourite phishing tactic because the real ones look the same. Run this quick scan:

• Read the sender's full address. “DocuSign” as a display name means nothing; the domain behind it is what counts. Watch for misspellings and look-alikes.
• Did you expect it? An out-of-the-blue request, especially an urgent one, earns a pause.
• Hover before you tap. Check where the button actually points.
• If anything feels off, go direct. Open the service yourself and find the document in your account instead of using the email link.

Set it up once: protect the account

If you send documents, your account is worth protecting properly — do this once and forget it:

• A unique password from a password manager.
• Two-factor authentication switched on — an authenticator app if you can.
• Login alerts enabled, so a stranger signing in gets noticed.

Pick the right strength for the document

A link to your inbox is enough for a routine form. For anything valuable, use the stronger verification your service offers — an SMS code, identity questions, or ID verification. The rule of thumb: the more the document is worth, the more proof of identity it deserves.

After you sign: confirm it

Thirty seconds of checking turns a signature into solid evidence:

• Open the certificate of completion — do the names, emails and timestamps look right?
• Did everyone who was supposed to sign actually sign?
• Does the file show as sealed and unaltered?
• Save your own copy somewhere you control.

That's the whole routine. It fits in the time it takes the page to load, and it heads off the overwhelming majority of signing mishaps. For the complete picture — authentication tiers, data residency and the structural pitfalls — see the full security guide.