Outstanding Invoice Email Scam: DocuSign-Style Phishing Warning

An Outstanding Invoice email scam is a phishing message that imitates a document-signing notification and pushes the recipient to open a fake invoice. In the current DocuSign-style version, the message says an invoice is ready for review and signature, then sends the user to a fake webmail login page instead of a real document. Do not use the button in the email. Verify the request from a known vendor portal or a saved contact, and change the mailbox password if credentials were entered.

This scam is different from a malware attachment campaign. The main risk is email account takeover: once attackers get the mailbox password, they can read invoices, reset other accounts, create forwarding rules, and send more phishing messages from a trusted address. If the email also downloaded a file, opened a browser extension, or asked you to run a tool, treat the computer as exposed and scan it before continuing account recovery.

What the Outstanding Invoice email looks like

The lure usually borrows the style of a document-signing service. It may use a subject such as Outstanding Invoice, a display name like Documents Team, and a large button labeled REVIEW & SIGN DOCUMENT. The text is short on purpose: it creates just enough urgency to make a finance, sales, or operations user click without checking the sender.

A safe document request should let you verify the sender, the envelope or document ID, the signing service domain, and the business reason for the invoice. The scam version usually hides those details. It may mention an overdue invoice, an audit notice, a payment deadline, or possible legal action, but it does not name a real purchase order, contract, vendor contact, or internal approver.

Example wording in the scam email

Use this as a recognition aid, not as a complete list of every variant:

Subject: Outstanding Invoice
From: Documents Team <notice [at] example-docs [dot] com>

Hello,

A document has been shared with you for review and signature. Please review the outstanding invoice before the end of the business day.

Button: REVIEW & SIGN DOCUMENT

This message was sent by an external document service.

Real attacks can swap in a different sender name, a compromised business address, a cloud storage link, or a fake webmail page that copies cPanel, Microsoft 365, or a corporate login screen. The key pattern is the same: an invoice or signature request is used to collect credentials.

Red flags to check before clicking

• The sender is not the vendor you expected. A display name can say DocuSign or Documents Team while the actual address uses an unrelated domain.
• The message asks you to sign in after the button. A fake invoice page that immediately requests your mailbox password is a stronger warning than a normal document preview.
• The invoice details are vague. Real invoice workflows usually include a vendor, account, purchase order, amount, or internal contact.
• The message creates pressure. Phrases about an overdue deadline, audit compliance, or legal action are used to reduce verification.
• The link destination is hidden or unfamiliar. Hover on desktop, long-press carefully on mobile, or open the message headers in a safe way. Do not log in through an unsolicited link.
• The request conflicts with normal process. If your company uses a procurement portal, accounting queue, or saved vendor contact, use that route instead of the email button.

How to verify it safely

1. Do not click the button again. If you already opened the page, close it and do not enter a password.
2. Open the signing or vendor service manually. Type the known domain yourself or use a saved bookmark. Do not copy the link from the email.
3. Check the sender out of band. Contact the vendor, customer, or internal requester using a known phone number or address from previous records.
4. Look for the document in the official portal. A legitimate signing request should be visible from the service account or envelope history.
5. Forward the suspicious message to your IT/security team. Keep the original headers if possible so they can inspect the sender path and linked domain.
6. Report DocuSign impersonation to DocuSign. Their trust guidance explains how to send suspicious messages for review.

For a broader checklist of sender, link, attachment, and wording clues, see our guide on how to spot a phishing email. If the same message claimed to include a legal document or pushed an ISO/EXE file, compare it with the separate DocuSign Legal Department Document email virus case, which is a malware-delivery lane rather than a login-theft lane.

What to do if you entered your email password

Act from a clean browser session or a different trusted device. Do not keep using the phishing page.

1. Change the mailbox password immediately. Use a unique password that was not reused on other services.
2. Sign out of all sessions. Most webmail and Microsoft 365/Google Workspace accounts let you revoke active sessions or force reauthentication.
3. Turn on MFA or reset MFA methods. If MFA was already enabled, verify that no new authenticator app, phone number, or backup method was added.
4. Check forwarding rules and inbox filters. Attackers often create rules that hide security alerts, delete replies, or forward invoices to an external address.
5. Review recent sign-ins. Look for unfamiliar countries, devices, user agents, impossible travel, or repeated failed attempts.
6. Warn finance and contacts if the account sent mail. A compromised mailbox can be used for invoice fraud or follow-up phishing from a trusted thread.
7. Reset linked accounts if needed. Email access can be used to reset banking, SaaS, cloud storage, and social accounts tied to the mailbox.

If the lure made you download a document, install a viewer, add a browser extension, or run a support tool, account cleanup is not enough. Save the suspicious file or URL for your security team, then scan the computer for leftovers. Gridinsoft tools can help with that triage: use the Gridinsoft Email Scam Checker for suspicious message text and links, and run Gridinsoft Anti-Malware if anything was downloaded or executed. A scan can look for detections, hidden files, startup entries, scheduled tasks, bundled apps, browser changes, and persistence; it cannot recover a stolen password or prove that no account was accessed.

Why invoice and signing lures work

Invoice requests are effective because they fit normal business routines. A real invoice may arrive unexpectedly, a document may require signature, and mobile email hides important sender and link details. Attackers combine that normal workflow with urgency: payment deadline, audit notice, legal action, or a manager asking why the invoice is not handled.

The safest habit is process-based verification. Treat an invoice email as a notification, not as the source of truth. Open the known vendor system, procurement queue, or signing service manually. If the document is real, it should still be there. If it only exists behind the email button, the request needs independent confirmation.

Prevention for finance and small-business teams

• Require out-of-band confirmation for new payment instructions. Never approve a bank detail change from an email thread alone.
• Keep a saved vendor contact list. Finance users should not have to trust a phone number or reply address from a suspicious invoice.
• Use mailbox rules monitoring. Alert on new external forwarding, hidden inbox rules, and mass deletion of security notices.
• Train around exact workflows. Show users examples of invoice, DocuSign-style, QR, and webmail-login lures, not only generic phishing definitions.
• Route suspicious mail to one review process. Users are more likely to report if they know exactly where to send a suspicious invoice.

FAQ

References

1. Docusign. “Report security incidents.” Docusign Trust Center, accessed June 23, 2026. https://www.docusign.com/trust/security/incident-reporting
2. Docusign. “Alert: New Phishing Campaign Observed, April 14, 2020.” Docusign Trust Center, updated May 6, 2020, accessed June 23, 2026. https://www.docusign.com/trust/alerts/alert-new-phishing-campaign-observed-april-14-2020
3. Federal Trade Commission. “How to recognize and avoid phishing scams.” FTC Consumer Advice, accessed June 23, 2026. https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams