Phishing and Fake Signature Requests: What to Watch For

People have gotten used to receiving legitimate emails asking them to review and sign a document, which makes a well-crafted fake version plausible in a way that many other phishing attempts aren't. The routine, expected nature of these emails is exactly what makes them useful to impersonate.

A mismatch between the sender's actual email address and the organization it claims to represent is one of the more reliable tells, even when the display name looks correct. Checking the actual address, not just the name shown, takes a few seconds and catches a meaningful share of attempts.

Urgency is another common signal. Legitimate signature requests rarely demand action within an unusually tight window; that kind of pressure is a common phishing tactic specifically because it discourages careful scrutiny.

When in doubt, don't click the link in the email at all. Instead, go directly to the platform the request supposedly came from, or contact the sender through a separate, known channel, to confirm the request is genuine before doing anything with it.