DocuSign QR Code Scam: What It Is and What to Do
A document that looks urgent can make a QR code feel routine. But a DocuSign-looking QR code in an email or PDF may lead to a fake signature portal, a fake login page, or a payment request you did not expect.
Common fake DocuSign QR lures
- Fake signature requests: the message says a contract, lease, NDA, or HR form is waiting and asks you to scan a QR code to review it.
- Invoice and payment lures: a PDF claims you must sign or pay an invoice before a deadline, then routes you to a fake vendor portal.
- Employment paperwork: job seekers receive a QR code for onboarding forms, equipment deposits, or tax forms.
- Credential capture: the page asks you to log in with Microsoft, Google, or DocuSign credentials before you can view the document.
This often overlaps with fake invoice QR code scams and fake job offer QR code scams.
How to verify before signing
- Confirm the sender out of band. If you were not expecting the document, call or message the sender through a channel you already trust.
- Use the official site. Type docusign.com yourself or open the official app. Do not rely on a QR code in an unexpected PDF.
- Check the context. The document title, sender, company name, and transaction should match something you recognize.
- Stop if a login feels unnecessary. A document review flow should not ask for unrelated email, bank, or payroll credentials.
What to do if you already scanned
If you only previewed the page and closed it, preserve the message and report it to the sender or your IT team. If you entered credentials, change that password on the official site, revoke active sessions, and enable two-factor authentication.
If you submitted payment or bank details, contact your bank immediately and verify with the real sender whether any payment was actually due.
Frequently asked questions
Can a DocuSign email with a QR code be fake?
Yes. Scammers use fake DocuSign emails and PDFs with QR codes to open credential-harvesting pages, fake document portals, or payment forms.
How do I verify a DocuSign request?
Confirm the sender through a known channel, open DocuSign from docusign.com or the official app, and compare the document title, sender, and expected transaction before signing.
What if I entered my password after scanning a DocuSign QR code?
Change that password immediately on the official site, enable two-factor authentication, and notify your employer or the organization that sent the supposed document.
Are QR codes inside PDFs riskier than links?
They can be, because the PDF displays an image rather than a clickable URL. Your phone opens the hidden destination, often outside the email security system.
Check document QR codes before opening them
QRsafer previews the destination so you can catch fake document portals before they load.