# New Phishing scam posing as Signature Sync

**URL:** <https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711>\
**Category:** The Darker Side - Protecting Yourself from Fraud\
**Created:** [August 14, 2026, 5:12pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711 "2026-08-14T17:12:32Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![tom.codd](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/tom.codd/32/37322_2.png) [@tom.codd](https://forum.notarycafe.com/u/tom.codd)\
**Post date:** [August 14, 2026, 5:12pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/1 "2026-08-14T17:12:32Z")

</div>

I just got a new one that I thought I would share. This email appears to come from Signature Sync, a known signing service. Attaching a screen shot of the email. Definitely Phishing. I had a signing yesterday with a guy whose business is to shut down hackers and Phishers. He shared a tool that I think everyone could benefit from. Its called VirusTotal. Open a browser page and go to [Virustotal.com](http://Virustotal.com). you can drag and drop suspicious files to the page and it will scan for you. Even better, you can copy the link to the suspicious file and paste it into the URL box and it will scan for you without you needing to click the suspicious link. both the links in the Signature Sync email were red-flagged immediately. Hope thjis helps others like me who are getting bombarded with Phishing emails everyday

 ![image](https://canada1.discourse-cdn.com/flex034/uploads/notarycafe/original/3X/7/1/71943e5f4cb3386528a01594e8f139950b51d335.png)

---

<div class="post-metadata">

**Author:** ![johnsonps306](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/johnsonps306/32/35090_2.png) [@johnsonps306](https://forum.notarycafe.com/u/johnsonps306)\
**Post date:** [August 14, 2026, 5:45pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/2 "2026-08-14T17:45:47Z")

</div>

Looks just like a Radian email except for the return address

---

<div class="post-metadata">

**Author:** ![tom.codd](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/tom.codd/32/37322_2.png) [@tom.codd](https://forum.notarycafe.com/u/tom.codd)\
**Post date:** [August 14, 2026, 6:02pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/3 "2026-08-14T18:02:28Z")

</div>

Yup. These guys are getting very good. I"m to the point that I will not open anything unless its from a signing service portal. I am also getting targeted by Phishers that know I live in Carlsbad, CA and they claim they live just down the street…using fake addresses. Ridiculous!

---

<div class="post-metadata">

**Author:** ![cNsa5](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/cnsa5/32/33381_2.png) [@cNsa5](https://forum.notarycafe.com/u/cNsa5)\
**Post date:** [August 14, 2026, 6:58pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/4 "2026-08-14T18:58:29Z")

</div>

@tom.codd✨ **Thank You** ✨ for sharing your _ **direct** _ experience.

```auto

```

🦢

---

<div class="post-metadata">

**Author:** ![skywalktrace](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/skywalktrace/32/33794_2.png) [@skywalktrace](https://forum.notarycafe.com/u/skywalktrace)\
**Post date:** [August 15, 2026, 3:54pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/5 "2026-08-15T15:54:08Z")

</div>

Thanks for sharing this information.

---

<div class="post-metadata">

**Author:** ![monikap](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/monikap/32/38586_2.png) [@monikap](https://forum.notarycafe.com/u/monikap)\
**Post date:** [August 15, 2026, 5:15pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/6 "2026-08-15T17:15:21Z")

</div>

The content is just distraction. Totally phishing email. Thx for sharing

---

<div class="post-metadata">

**Author:** ![monikap](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/monikap/32/38586_2.png) [@monikap](https://forum.notarycafe.com/u/monikap)\
**Post date:** [August 15, 2026, 5:18pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/7 "2026-08-15T17:18:48Z")

</div>

![Screenshot (4)](https://canada1.discourse-cdn.com/flex034/uploads/notarycafe/original/3X/8/1/812d9a46b38070bb3c03ef37b3a8a6845a80aba3.png)

---

<div class="post-metadata">

**Author:** ![LKTHORNTON1](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/lkthornton1/32/37331_2.png) [@LKTHORNTON1](https://forum.notarycafe.com/u/LKTHORNTON1)\
**Post date:** [August 15, 2026, 11:16pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/8 "2026-08-15T23:16:39Z")

</div>

Just about every real entity I do business with has a disclaimer on their first page about scams and phishing, and that they don’t solicit via social media or charge fees to do such-and-such. I don’t think the internet itself is going away or getting simpler — if anything, more of this is moving online, not less. But I could see more companies leaning back toward phone verification or in-person confirmation for anything involving money or sensitive documents, the way title companies now call to verify wire instructions before releasing funds. The trust problem is real, and a phone call or face-to-face still does something a webpage disclaimer can’t.

---

<div class="post-metadata">

**Author:** ![tricitynotaryfremont](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/tricitynotaryfremont/32/35195_2.png) [@tricitynotaryfremont](https://forum.notarycafe.com/u/tricitynotaryfremont)\
**Post date:** [August 16, 2026, 7:16pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/9 "2026-08-16T19:16:42Z")

</div>

(post deleted by author)

---

<div class="post-metadata">

**Author:** ![tricitynotaryfremont](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/tricitynotaryfremont/32/35195_2.png) [@tricitynotaryfremont](https://forum.notarycafe.com/u/tricitynotaryfremont)\
**Post date:** [August 16, 2026, 7:20pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/10 "2026-08-16T19:20:06Z")

</div>

(post deleted by author)

---

<div class="post-metadata">

**Author:** ![keaton4notary](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/keaton4notary/32/33597_2.png) [@keaton4notary](https://forum.notarycafe.com/u/keaton4notary)\
**Post date:** [August 17, 2026, 9:08pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/11 "2026-08-17T21:08:51Z")

</div>

Thanks! Everything but the return address! I’ll have to look at these closer from now on.

---

<div class="post-metadata">

**Author:** ![DC\_NSA](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/dc_nsa/32/37131_2.png) [@DC\_NSA](https://forum.notarycafe.com/u/DC_NSA)\
**Post date:** [August 19, 2026, 3:49pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/12 "2026-08-19T15:49:08Z")

</div>

Thanks for the heads up. We have to protect each other.

---

<div class="post-metadata">

**Author:** ![nea.notarysolutions](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/nea.notarysolutions/32/34953_2.png) [@nea.notarysolutions](https://forum.notarycafe.com/u/nea.notarysolutions)\
**Post date:** [August 21, 2026, 12:15pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/13 "2026-08-21T12:15:32Z")

</div>

And the dear “insert email address” this is crazy!

---

<div class="post-metadata">

**Author:** ![nea.notarysolutions](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.notarycafe.com/nea.notarysolutions/32/34953_2.png) [@nea.notarysolutions](https://forum.notarycafe.com/u/nea.notarysolutions)\
**Post date:** [August 21, 2026, 12:18pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/14 "2026-08-21T12:18:39Z")

</div>

It being that realistic to an actual signature closers email makes me believe the hacker is a current or former notary! I guess a notary could have posted a screen shot of a documents received email though I’m not sure why they would have. Either way this is crazy!! Thanks for sharing!

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex034/uploads/notarycafe/original/2X/5/536ced5cfa77a57223f140e81670eb5e2685a07d.jpeg) [@system](https://forum.notarycafe.com/u/system)\
**Post date:** [September 20, 2026, 12:19pm UTC](https://forum.notarycafe.com/t/new-phishing-scam-posing-as-signature-sync/57711/15 "2026-09-20T12:19:01Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
