DocuSign Security FAQ

Is the DocuSign email legitimate?

A few steps can be taken to verify the DocuSign email is not a phishing attempt

• If you don't recognize the sender of a DocuSign envelope, and you are uncertain of the authenticity of an email, look for the unique security code at the bottom of the notification email. All DocuSign envelopes include a unique security code. See the example below:
  
  
• If there IS a security code... and you're still unsure about the authenticity of the email, access your documents directly from www.docusign.com, Click Access Documents, then enter the unique security code.
  • Or go to www.docusign.net and login to DocuSign using your NDUS Authentication ID. Click on Action Required to view all the documents that require your signature.
• If there is NO security code... DO NOT click on links or open attachments within the email. This is not a valid DocuSign email, and it should be sent to our security team immediately by submitting a phishing report.
• Look for the same red flags as phishing emails. 

Did the intended recipient sign this document?

This concern would be the same with a wet signature. There is nothing physically stopping someone else from signing the document. If UND were to require login for all envelopes, this would affect 3^rd party signers such as guardians that don’t have a DocuSign account, which is a paid service.

• Use this Docusign validation website to verify signatures of signed documents.

What is the level of confidence in DocuSign?

If the document is from an NDUS/UND account, the confidence is high because Single Sign On (SSO) and dual-factor authentication are attached to the system.

Additionally, the Certificate of Completion provides a permanent audit trail for each sender, signer, approver, or recipient. This certificate is created during each DocuSign signing process.

Does DocuSign have dual-factor authentication?

Yes, dual-factor is active on all UND accounts when logging directly into DocuSign.

Should initiators of a document send a secondary “heads up” communication to the potential signers?

The initiator/sender would decide if a “heads up” email would be beneficial.