The E-Signature Notice That Asked for No Signature

Every e-signature phishing lure a security awareness program trains on is a request. Please sign. Review and sign. Your signature is required. The training payload is a question the user is supposed to ask: was I expecting to sign something? In mid-August, a payroll specialist at a national in-home senior care provider received a mortgage closing notice that quietly removed that question from the board. Its headline announced that a file named for a closing disclosure and closing instructions "has been signed by all signers." The signature step was presented as finished. Whatever remained to do, signing was not part of it.

An Inversion of the Pretext Defenders Train Against

That single change of tense does real work. An action is still solicited here, three times over: the subject line ended with "Please review and proceed," the body offered a "View the document" button under the line "Your Loan Closing Package is Available," and the destination page repeated "Continue below to open secure document." But the ask has degraded from signing to looking, and looking feels like the lower-stakes half of the pair. A recipient who has been drilled to interrogate signature requests finds nothing in the message that matches the shape they were taught to distrust. The heuristic does not fail. It simply never fires.

The mismatch that should have fired is a different one. The recipient works in payroll at a home-care company. She has no mortgage loan in progress, no broker relationship and no reason to receive a closing package from a wholesale lender. Role relevance, not signature semantics, was the available tell, and it is harder to train because it asks the reader to reason about why a message arrived rather than what it asks for. MITRE tracks the delivery half of this as phishing via a malicious link and the payoff half as user execution of that link, and the 2026 Verizon Data Breach Investigations Report still puts phishing behind 16 percent of breaches as an initial access vector, with the human element implicated in 62 percent overall.

A Portal Page With Nowhere to Type

The lone real link in the message pointed to a free Square Online storefront subdomain. What loaded there was not a login screen. It was a faithful reproduction of the impersonated lender's brand: the correct logo, a document-signing hero image, the headline "United Wholesale Mortgage has shared a document with you," reassuring copy about a secure delivery portal, and one button reading "VIEW CLOSING DOCUMENT." There were zero input fields of any kind on the captured page. No username box, no password box, no verification code, nothing.

That is a gate, not a harvest page, and it explains an artifact that would otherwise look like a detection miss. When the URL was checked, the verdict came back "Mixed Result" with a partial rating, which is precisely the same verdict the same scan returned for a plainly benign google.com anchor sitting in the same message. On a page that collects nothing and does nothing, a reputation engine has very little to grade. Themis attached a "Credential Theft" label to the incident, and that label is worth quoting alongside its own caveat: it is an inference, not an observation. Whatever waited behind that button was never captured, and asserting a credential form on a page that demonstrably has none would be inventing the interesting part of the story. Site-builder platforms like this one are generic abused infrastructure rather than campaign identifiers, which is why advanced malware and URL protection has to happen at link time rather than by block list.

See Your Risk: Calculate how many threats your SEG is missing

Why the Envelope Checked Out Clean

The message was composed and sent from inside the Microsoft 365 tenant of a real European industrial manufacturer, by a mailbox belonging to a real employee there. Internal Exchange headers place the origin inside that tenant rather than spoofed from outside it. The consequence is that nothing about the authentication was forged. The company's own mail exchangers passed SPF, the company's own DKIM selectors signed the message, and DMARC aligned and passed, both at the upstream Microsoft hop and again at the recipient's Google front end. Microsoft's own filtering scored the message as non-spam on the way out.

Two per-hop details are routinely misread as failures. A pre-signing stamp inside the originating tenant records DKIM as none, which is what an unsigned message looks like before its own tenant signs it, not a broken signature. And the sending domain signs with two algorithms, one of which resolves as neutral for want of a published key, so a fully authenticated message still carries one unverifiable signature. Neither is the gateway artifact pattern where authentication collapses only at the final hop. This is the inverse: a genuine end-to-end pass. The relevant reading of RFC 9989 is that alignment tells you which domain took responsibility for a message, and here a legitimate domain genuinely did. Clean reputation was borrowed rather than counterfeited, and borrowed without any correspondence history to hijack: the sender was a first-time correspondent with no prior exchange in either direction.

The Seams in the Template

The forgery held up at the envelope layer and frayed in the content layer. The subject line carried a full loan number while the body masked the same number down to its last three digits, the signature of an operator who templated the body and forgot the header. Social icons in the footer were still titled for an unrelated legal-practice software brand. The lender's own tagline rendered garbled by a botched template substitution. The sender alias inside the fake signature block had its name transposed and misspelled. Three footer anchors displayed the lender's domain as visible text while pointing at google.com, a benign-destination decoy that dilutes link scoring. And roughly thirty empty padding blocks sat below the fake notice, pushing the sending employee's own genuine corporate signature far below the fold.

None of that reaches a user who never scrolls. What did reach the incident queue was automated: no one reported this message. IRONSCALES flagged and resolved it as phishing on its own, with Themis at 83 percent confidence, citing the flagged link plus language and structure cues associated with sophisticated phishing. That matters more than usual here, because the two checks a human is most likely to run, does this authenticate and am I being asked to sign, both returned reassuring answers. Guidance from CISA and the NIST definition of phishing both frame the discipline around the deception rather than the transport. Across the 36,000+ security professionals in 18,000+ organizations in our community, the lures that travel furthest are increasingly the ones that ask for the smallest thing.

Indicators of Compromise

MITRE ATT&CK Mapping

What This Case Should Change

Three things are worth carrying forward. Awareness content built around signature requests has a blind spot shaped exactly like this message, and the fix is to teach "why did this arrive for me" alongside "was I expecting this." A form-free branded gate is a deliberate choice that starves reputation scoring of anything to score, so a mixed or partial verdict on a brand-faithful page deserves escalation rather than relief. And full authentication is a statement about a mailbox, not a message. When the mailbox is real, the signatures are real too, and every remaining signal has to come from relationship context and content analysis rather than the envelope.