{"id":1209,"date":"2025-11-18T13:40:16","date_gmt":"2025-11-18T18:40:16","guid":{"rendered":"https:\/\/www.montclair.edu\/phish-files\/?p=1209"},"modified":"2026-02-16T13:35:51","modified_gmt":"2026-02-16T18:35:51","slug":"document-for-signature","status":"publish","type":"post","link":"https:\/\/www.montclair.edu\/phish-files\/2025\/11\/18\/document-for-signature\/","title":{"rendered":"You&#8217;ve received a Document for Signature"},"content":{"rendered":"<h2><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.montclair.edu\/phish-files\/wp-content\/uploads\/sites\/290\/2025\/12\/docusignsimcredpage-1024x515.png\" alt=\"Screenshot of the landing page posing as the docusign login.\" width=\"1024\" height=\"515\" \/><\/h2>\n<h2>Why We Run Phishing Simulations<\/h2>\n<p data-path-to-node=\"4\">Cybersecurity threats are constantly evolving, and the best defense we have is an informed and vigilant team. We run phishing simulations\u2014like the fake DocuSign you recently received\u2014to provide a safe, hands-on opportunity to practice recognizing the latest attack techniques. This is your chance to sharpen your skills so you can spot and stop real criminals trying to steal data and compromise our network.<\/p>\n<h2>Why this looks valid:<\/h2>\n<ul>\n<li>\n<p data-path-to-node=\"5,0,0\"><strong>Trusted Name:<\/strong> It used a familiar service (DocuSign) and a simple, friendly signature (&#8220;Best, Ann&#8221;).<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"5,1,0\"><strong>Urgency: <\/strong>The message said, &#8220;Please send back as soon as you can,&#8221; creating pressure to click fast.<\/p>\n<\/li>\n<\/ul>\n<h2>The Two Biggest Red Flags<\/h2>\n<p data-path-to-node=\"8\">If you learn to check these two things, you will spot 99% of phishing attempts:<\/p>\n<h3>Flag 1: The Link Address<\/h3>\n<ul data-path-to-node=\"10\">\n<li>\n<p data-path-to-node=\"10,0,0\"><strong>The Problem:<\/strong> The most critical red flag in this email was the address behind the link.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"10,1,0\"><strong>What to Check: Hover your mouse over the link (DO NOT CLICK!).<\/strong><\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"10,2,0\"><strong>The Give Away:<\/strong> The URL in the fake email started with <code>https:\/\/doc-m0ntclair.internalportal.net\/<\/code>. <strong>A legitimate DocuSign link must start with <code>docusign.com<\/code>.<\/strong> The non-matching, slightly misspelled domain is the sign of a scam.<\/p>\n<\/li>\n<\/ul>\n<h3><strong>Flag 2: Suspicious Process<\/strong><\/h3>\n<ul>\n<li data-path-to-node=\"12,0,0\">The email provided the main link <strong>and<\/strong> a long, unique &#8220;Security Code&#8221; at the bottom as a second access option.<\/li>\n<li>\n<p data-path-to-node=\"9,1,0\"><strong>The Lesson:<\/strong> Attackers often add multiple official-looking details (like the code and the boilerplate text) to make the scam seem more legitimate. They want these details to distract you from the <strong>real threat: the malicious link destination<\/strong> (Flag 1). <strong>Always prioritize checking the link address.<\/strong><\/p>\n<\/li>\n<\/ul>\n<h2><strong>Your 3-Step Action Plan<\/strong><\/h2>\n<p data-path-to-node=\"20\">This is all you need to do every time you receive an urgent request:<\/p>\n<ol start=\"1\" data-path-to-node=\"21\">\n<li>\n<p data-path-to-node=\"21,0,0\"><strong>STOP:<\/strong> Don&#8217;t click anything immediately.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"21,1,0\"><strong>HOVER &amp; CHECK:<\/strong> Check the link destination address. If it doesn&#8217;t match the expected, official domain (e.g., <code>docusign.com<\/code> or <code>montclair.edu<\/code>), treat it as dangerous.<\/p>\n<\/li>\n<li>\n<p data-path-to-node=\"21,2,0\"><strong>VERIFY &amp; REPORT:<\/strong> Follow the procedure below to safely report the suspicious email.<\/p>\n<h3>Reporting a Phishing Email<\/h3>\n<p data-path-to-node=\"23,1\">If you identify a suspicious email, your action is crucial to protecting the entire organization. <strong>DO NOT<\/strong> forward the message or reply to the sender.<\/p>\n<ul data-path-to-node=\"23,2\">\n<li>\n<p data-path-to-node=\"23,2,0,0\"><strong>User the Phish Alert Button (PAB):<\/strong> Click the PAB hook immediately. This safely moves the email off your screen and alerts Information Security.<\/p>\n<ul data-path-to-node=\"23,2\">\n<li>Psst! If the email you received ends up being a simulation the PAB will tell you!<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<h2>Additional Notes:<\/h2>\n<ul>\n<li>Do you think you&#8217;ve fallen for a scam? Did you share personal information? Downloaded malicious content? Please contact the IT Service Desk at <a href=\"tel:973-655-7971\">973-655-7971<\/a>\u00a0option 1 or email <a href=\"mailto:itservicedesk@montclair.edu\">itservicedesk@montclair.edu<\/a>.<\/li>\n<li>Use the <a href=\"https:\/\/www.montclair.edu\/information-technology\/security\/pab\/\">Knowbe4 Phish Alert Button (PAB)<\/a> to report malicious emails directly to the Information Security team for review. If you are not using the Gmail client please forward the email to <a href=\"mailto:phishfiles@montclair.edu\">phishfiles@montclair.edu<\/a>.<\/li>\n<li>Always use the &#8220;hover over&#8221; technique to check web links before clicking! For more security tips please visit our <a href=\"https:\/\/www.montclair.edu\/information-technology\/security\/security-tips\/\">Security Tips<\/a> page.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Why We Run Phishing Simulations Cybersecurity threats are constantly evolving, and the best defense we have is an informed and vigilant team. We run phishing simulations\u2014like the fake DocuSign you recently received\u2014to provide a safe, hands-on opportunity to practice recognizing the latest attack techniques. This is your chance to sharpen your skills so you can [&hellip;]<\/p>\n","protected":false},"author":349,"featured_media":1211,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[12],"tags":[],"class_list":["post-1209","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-simulation"],"_links":{"self":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/1209","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/users\/349"}],"replies":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/comments?post=1209"}],"version-history":[{"count":4,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/1209\/revisions"}],"predecessor-version":[{"id":1399,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/1209\/revisions\/1399"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/media\/1211"}],"wp:attachment":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/media?parent=1209"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/categories?post=1209"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/tags?post=1209"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}