Is this email genuine? How to spot a fake signing request

"Please review and sign" is one of the most imitated emails on the internet, because people open it. This guide gives you a check that takes half a minute and needs no account, explains which domain a genuine AiresDocs link always opens on, lists what we never ask for, and, if you send contracts yourself, how to keep your own invitations out of the spam folder.

Why fake signing emails exist

A signing request has everything a phishing email wants: a reason to click, a sense of urgency, and a page that asks you to type things. Fakes copy the look of every well-known e-signature service. The look proves nothing; the two things that cannot be copied are the record of what was actually sent and the domain the link opens on.

The 30-second reference check

1. Find the contract reference in the email. The invitation to sign that AiresDocs sends you ends with "Is this email genuine? Check the contract reference …" followed by a long code and the address of the check page. Reminders may not carry it, so use the original invitation. The email you get once everyone has signed quotes the same code as the contract ID.
2. Open the check page yourself. Type app.airesdocs.com/verify into your browser rather than clicking anything in the email, and paste the reference under "Is this email genuine?".
3. Compare. The page says whether we sent email about that contract, who the sender is, their email domain, when it went out and the recipients with their addresses partly masked. If the sender in your email, their domain or your own address does not match, or the page says we never sent it, do not sign.

A reference is a random 36-character code that appears only in the emails about that contract and on its certificate, so it cannot be guessed. Signing links are never shown on the check page.

Where a genuine link opens

Every signing link we send opens on app.airesdocs.com. Hover over the button (or long-press on a phone) and look at the full address before you tap. Anything else, including look-alike spellings and addresses where our name appears only after a slash, is not us. The page you land on never asks you to log in to your email provider and never asks for an account password. The only codes it may ask for are an access code the sender gave you themselves, or a code texted to your phone after you open the link.

What we never ask for

• Your email, Microsoft or Google password, or any account password: signers do not have accounts. (A sender may protect a contract with an access code that they give you themselves, by another route.)
• Payment to receive, unlock or download a contract. Where a sender collects a payment as part of signing, it happens after you have read the contract, on the signing page, through the sender's own card processor; never by bank transfer and never to release the document.
• Codes sent to your phone, unless the sender set up SMS verification, in which case the code arrives after you open the link, not before.
• Software to install, attachments to enable macros in, or "updated" apps.

SPF, DKIM and DMARC: what your mail provider checks

Three published DNS standards let a receiving mail provider confirm that an email claiming to come from a domain really was sent by that domain's systems: SPF lists the servers allowed to send for the domain, DKIM signs each message so changes in transit are detectable, and DMARC tells providers what to do when either check fails and where to report. Most providers show the result in the message details ("signed by", "mailed by") and move failures to spam or reject them. When our sending domain's records are verified, the footer of our emails says so; the absence of that line, or a different "mailed by" domain, is a reason to run the reference check.

These checks protect the sending domain, not the content. A criminal can register their own domain with perfect SPF, DKIM and DMARC and send a convincing fake from it, which is why the reference check and the link domain matter more than any badge.

If you send contracts: keep your emails out of spam

• Tell people a contract is coming, by a message they already trust, with the title you used. Expected emails get opened; unexpected ones get reported.
• Use your real name and company as the sender name. Invitations name you as the sender, with your email address, so the recipient can match them to a person.
• Point recipients at the reference check if they hesitate. It is quicker than a phone call and shows them the recipient list.

Report a suspicious email

Forward it, with the full headers if you can, to security@airesdocs.com. We check the reference against what we sent, and if someone is imitating us we work with the hosting provider to take the page down. If you have already typed a password into a page reached from such an email, change that password now and tell your IT contact.

This guide explains how things work in general terms and is not legal advice. Spotted something out of date? Email support@airesdocs.com and we will check it against the source.