Fake 'Please Sign' Emails Can Skip Your Spam Filter. Here's Why, and 3 Checks

"Please review and sign." "Your invoice is ready." "Quick survey for you." These are some of the most ordinary emails a business receives, which is exactly why scammers copy them.

A new Microsoft report shows that many fake versions of these emails reached inboxes even after they were spotted as malicious. The reason was not clever technology. It was a setting many businesses switch on to stop real emails going to spam.

What Microsoft found

In its email threat report for July to September 2026, published on November 5, Microsoft says:

• It detected about 129 million malicious emails that pretended to come from well-known business services, such as e-signature, document and survey tools.
• DocuSign was the most copied name in September, at 29% of that month's total. Adobe, SurveyMonkey and Barracuda were also copied more toward the end of the quarter.
• These emails failed the standard checks that prove who sent a message, and they were flagged as malicious.
• Even so, in September, 63% of these messages with a recorded outcome were covered by an "allow" exception set by the organization or the user.

Microsoft is careful to add that these figures do not show whether anyone opened the emails or lost an account. They do show that a well-meant exception can open a door.

Why an "always allow" rule helps scammers

Most email systems let you mark a sender or service as trusted, so its messages skip the spam folder. Teams often do this after a real contract or invoice notice got lost once.

The trouble is that a broad rule like "always allow anything that says it is from our e-signature service" also lets in fakes that only claim to be from that service. In Microsoft's words, "Familiar branding is not a substitute for an authenticated sender." Authenticated simply means the email passed the checks that prove it really came from that company.

Three checks for this week

1. Ask for a list of your "always allow" rules. Ask whoever runs your email, whether that is your IT provider or a staff member, to list every rule that lets mail skip the filter. Remove the ones nobody can explain, and narrow the rest so mail must still pass the sender checks.

2. Open signing and invoice requests from the service itself. When a "please sign" or "invoice ready" email arrives, go to the service by typing its address or using a bookmark, and look for the document there. If it is real, it will be waiting. If you were not expecting it, confirm with the sender using contact details you already have.

3. Make sure fakes of your own domain get refused. Scammers also send emails pretending to be from your business, to your customers and suppliers. A DNS setting called DMARC tells receiving mail servers what to do with mail that fails the sender checks: deliver it, send it to spam, or refuse it. If yours is missing or set to "deliver", fakes using your domain can still arrive.

Where CertPing fits

CertPing's free DMARC checker reads your domain's public SPF, DKIM, DMARC and MX records and shows whether anyone could send email as your domain. It is free, needs no account and changes nothing in your DNS.

If you want help fixing it, CertPing email security sets up SPF, DKIM and DMARC, shows which services send email as your domain, and guides you step by step toward refusing fakes. A stricter setting is only applied when you confirm it.

To be clear about the limits: CertPing protects your own domain from being used in fake emails. It does not filter the mail that arrives in your inbox. Your "always allow" rules live in your email system, so check 1 above is a job for your email provider or IT contact. Receiving mail servers also make the final decision on DMARC; CertPing sets the policy they follow.

The short version

Fake "please sign" emails are common because the real ones are common. Review the rules that let mail skip your filter, open documents from the service directly, and check whether your own domain can be faked.