When a Fake DocuSign Email Pretended to Be a Local Business
Julie helps handle email and office tasks for a local business in East Haven. One day, someone the business knew received a message that appeared to come from Julie. It looked like a routine document request and used familiar DocuSign-style wording, asking the recipient to review a document.
At first glance, the email looked convincing. It used the business name and an address that appeared familiar, but the link told a different story. Instead of going to DocuSign, the button led to an unrelated web domain. Even some of the contact information in the signature was slightly different from the real business information.
That raised the important question: had someone actually gotten into the business Gmail account, or was an outside scammer simply pretending to be Julie? I checked the Gmail Sent folder, account-security sessions, connected computer and Android activity, browser extensions, Gmail settings, and the computer itself with Malwarebytes. Nothing suspicious turned up in those checks.
Because the original phishing message was no longer available with its complete email headers, I could not prove with absolute certainty how the sender address had been used. Based on the evidence we did have, outside spoofing or impersonation was more likely than a compromised Gmail account.
This was a different kind of computer-security problem. Nothing had to be removed from the computer, but the investigation still mattered. A familiar sender name, a company signature, and a DocuSign-style message can all be copied. The destination of the link, and whether the message makes sense in the first place, can tell a very different story.
This is a Scam / Fraud Help issue I investigated for a local business in East Haven.
More scam and fraud stories: Scam / Fraud Help
