How to tell a real signing request from phishing

Why "a document to sign" is a favorite disguise

A signing request asks you to click a link and act on something that sounds important, which is exactly what a phishing email needs, and well-known e-signature brands are impersonated. DocuSign's safety center, for example, says threat actors "often impersonate well-known, trusted brands like Docusign to lure you into revealing your credentials and other private information" (as published on October 12, 2026). In May 2017, DocuSign warned of emails that "spoofed" its brand to trick recipients into opening an attached Word document that installs malicious software, and reported that an outside party had gained access to a separate system holding a list of email addresses.

A request can also come through a genuine service and still be a fraud. In November 2024, BleepingComputer reported that attackers with paid DocuSign accounts used its Envelopes API to send realistic fake invoices. So two questions matter: is the email really from the service, and is the request really from someone you deal with?

The warning signs in any signing email

The US Cybersecurity and Infrastructure Security Agency (CISA) lists the common signs of phishing: "Urgent or emotionally appealing language", "Requests to send personal and financial information", "Untrusted shortened URLs" and "Incorrect email addresses or links". It adds that bad grammar is no longer a reliable sign, since some phishing emails now have perfect spelling. The US Federal Trade Commission's list of stories phishing emails tell includes a problem with your account or payment information and "an invoice you don't recognize".

For a signing request in particular, be suspicious when:

• you don't know the sender, or you weren't expecting a document from them;
• the email has an attached file you are asked to open to "view the document";
• the link, once you check where it goes, isn't on the signing service's own website;
• the page asks you to sign in with your email account's password, or to pay, to see the document;
• the email pushes you to act at once, before an expiry you never heard about.

Exactly what Attest's emails look like

Every Attest signing email shows "Attest by DataHubz" at the top and "Attest by DataHubz · Verifiable agreements and evidence" at the foot, and its button opens a page on attest.datahubz.com. The invitation, the reminders and the email saying a document is ready to sign also print the link in full under the button, so you can read it. These are the emails a signer receives:

Email	Subject	What it says	Button	Where the link goes
Invitation	Signature requested by [sender]: [title]	The sender asks you to sign [title] with Attest, with their note if they wrote one and, if you're new to Attest, the two steps ahead	Review and sign (See where it stands, if your key is set up and the sender hasn't unlocked your copy yet)	https://attest.datahubz.com/sign/ followed by a 52-character code made for you
Reminder	Reminder: [sender] asked you to sign “[title]”	The sender is still waiting for your signature, and the expiry date if there is one	Review and sign	The same signing link
Released	Ready to sign, from [sender]: [title]	"[sender] unlocked [title] for you"	Open and sign	The same signing link
Completed	Completed: [title]	Every party has signed; its record is being anchored on Horizen, the certificate shows when it is, and from then on anyone can verify it independently	View verification certificate	https://attest.datahubz.com/a/ followed by the agreement's ID, which starts agr_
Withdrawn	Withdrawn by [sender]: [title]	The sender withdrew it, and the reason if they gave one	None	None
Expired	Expired: [title]	It reached its expiry date before everyone signed	None for signers	None

If you send documents, you also get "[signer] is waiting for you to unlock “[title]”" (and, as reminders after 1 hour and after 6 hours, "Reminder: [signer] is still waiting for you to unlock “[title]”") with an Unlock it for … button that opens https://attest.datahubz.com/release/ and the agreement's ID, which takes you to the agreement in Attest, and "Declined: [title]" when a signer declines. When you ask to sign in, the email is "Sign in to Attest", with a Sign in to Attest button and an 8-character code for the page where you asked; both are valid for 15 minutes, and using one ends the other. It says where and when the sign-in was asked for, and to enter the code only at attest.datahubz.com; if you didn't ask, ignore it.

Two more emails tell you your key changed. "A passkey was added to your Attest account" names the new passkey's device and browser and has a Review your passkeys button; "Your Attest signing key was reset" has an Open your Security page button and a contact link, attest.datahubz.com/contact. Both open pages on attest.datahubz.com. If you didn't make the change, secure your email account first, then remove the passkey on your Security page or, after a reset, contact DataHubz through that link.

These emails tell you about a change; they can't stop one made from your own mailbox. Signing in with your email alone can't add a passkey to your key, but whoever controls your mailbox can still sign in and reset your key, which needs no passkey or recovery phrase (a reset is for someone who has lost both), and so get a new key and passkey in your name. A reset removes your old passkeys and sends documents waiting for your signature back to their senders to release again, and its email goes to that same mailbox. Your Attest account is as secure as your email account, so protect that account.

What an Attest email never contains:

• An attachment. Attest's emails carry no files. The document is end-to-end encrypted and opens only in your browser, on attest.datahubz.com.
• A request for a password. Attest has no passwords, and you never sign in to Attest with your email provider's account. You sign in with a link or code emailed to you, or with a passkey.
• A request to pay to see or sign a document. The people who sign never pay, on any plan, so no signing email asks for money. Attest's only email about paying is a different one: it goes to the owners of an organization whose plan DataHubz sponsors, offering a subscription to keep that plan, and its Review the plan button opens the organization's page on attest.datahubz.com.
• A request to reply with personal details, codes or bank information. The code in a sign-in email goes only into the page on attest.datahubz.com where you asked for it.

Attest emails always come from "Attest by DataHubz" <attest@attest.datahubz.com>, including the ones a person sends you through Attest: Attest never puts a name someone typed in the From line. An invitation, a reminder, a "ready to sign" email or a withdrawal names the sender in its subject and first line, where [sender] above is the name they typed on their account followed by their email address, as in "Mary Ruiz (mary.ruiz@domain.com)", or their email address alone when they didn't type a name. That name is what the sender typed, and Attest doesn't verify it; the email address beside it is the one they sign in to Attest with, and it's the one to recognize. Replies to those emails go to the sender.

A name, and even an address, can be forged. The checks that hold: the button and the printed link open a page on attest.datahubz.com, your passkey prompt names attest.datahubz.com, and the page shows the same sender's address and document title as the email.

Check the link before you click

On a computer, rest the pointer on the button and read the address your browser shows. On a phone, press and hold the button to preview the link. For Attest, the address must begin exactly https://attest.datahubz.com/ with the slash right after .com. An address such as attest.datahubz.com.example.net, or attest-datahubz.com, is a different website.

The check a fake page can't pass: your passkey

When you sign with Attest, you approve with a passkey: a cryptographic key only you control, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. A passkey is made for one website and works only there. The WebAuthn standard behind passkeys says a passkey "can only be used for authentication with the same entity (as identified by RP ID) it was registered with", and Microsoft notes that passkeys "are enforced by the browsers or operating systems to only be used for the appropriate service, rather than relying on human verification."

Your Attest passkey is made for attest.datahubz.com. On a copycat site, your browser has no Attest passkey to offer, so there is nothing for the fake page to capture, and every Attest signature records the website it was made on, which the verifier checks. If you already have an Attest passkey and a page that looks like Attest can't find it, check the address bar before doing anything else.

One caution: until you set up your passkey, your signing link is what lets you set one up. Don't forward it. Once you have an Attest key, the link alone can't sign: Attest asks for a passkey registered to your email address, and a signing link never replaces a key you already have.

Not sure? Go around the email

CISA's advice for a message that might be real: "if you think it could be real, don't click on any link or call any number in the message. Look up another way to contact the company or person directly". With Attest you can do that in two ways:

1. Check with the sender through an address or phone number you already have, not the one in the email.
2. Open Attest yourself. Type attest.datahubz.com into your browser, click Sign in, enter the address the request was sent to, click Email me a sign-in link and open the link Attest emails you. Open Documents (or Agreements): a real request appears under Action needed when it's your turn, with the sender's email address and a Review and sign button (or Continue, if you still need to set up your key).

If you clicked a suspicious link

Don't type anything into the page. If you already entered a password somewhere, change it on that service, starting with your email account. Report the message with your email program's report button, or forward it to reportphishing@apwg.org, an address the FTC lists, and report fraud at ReportFraud.ftc.gov.