An email says a colleague or contact has shared a document with you — an invoice, a proposal, a spreadsheet — and a friendly button invites you to “open” or “view” it. It looks just like a real cloud-sharing notification. But the link leads to a fake sign-in page, and the only thing being shared is a trap for your password. Our GetMyPassword team explains how to recognize a shared document phishing scam.
How the scam works
You receive a message mimicking a cloud service like a document, drive, or file-sharing tool, saying someone has shared a file with you. The email often spoofs a real name — a coworker, a client, a brand — and sometimes comes from a genuinely hacked account, which makes it very convincing. Clicking “view document” leads to a fake login page for your email or cloud account, capturing your password, or to a page that prompts a malicious download. Because the request looks like ordinary collaboration, your guard is down — which is exactly the point.
Red flags to watch for
- An unexpected “shared document” you were not anticipating.
- A vague file — “invoice,” “document,” “proposal” — with no real context.
- A login prompt after clicking, asking for your email or cloud password.
- A sender or link domain that does not match the real cloud service.
- Pressure to open it quickly, or a message from an out-of-character contact.
Why it slips past your guard
Shared-file notifications are a normal part of working and collaborating online, so they do not trigger the suspicion that a stranger’s email would. When the sender appears to be someone you know — especially from a hacked account — the message feels routine. The key defense is to remember that opening a genuinely shared file does not require you to re-enter your password on a page you reached from a link. If a “document” sends you to a sign-in screen, stop: go to your cloud service directly and check whether anything was actually shared with you.
Opening a real shared file does not ask you to log in again on a linked page. When a “document” leads to a sign-in screen, the file is the bait and your password is the target.
How to protect yourself
Do not click “view” on unexpected shared-file emails; instead open your cloud service directly to see whether a file was really shared with you. Verify with the supposed sender through a known channel if you are unsure, and never re-enter your password on a page reached from a link. Protect your email and cloud accounts with two-factor authentication and a unique password from our password generator, so a captured password cannot unlock everything. If you logged in on a fake page, change that password immediately and review account activity.
Frequently asked questions
Is a “someone shared a document” email a scam?
An unexpected shared-file email that leads to a login page asking for your password is a common phishing scam. Opening a genuinely shared file does not require re-entering your password on a page you reached from a link. Check your cloud service directly.
Why does it look like it is from someone I know?
Scammers spoof real names or send from genuinely hacked accounts to appear trustworthy. A familiar sender does not guarantee safety — verify unexpected shares through a known channel before clicking.
What if I logged in on the fake page?
Change your email and cloud passwords immediately from the official app, turn on two-factor authentication, and review recent activity and sharing settings. Update the password anywhere you reused it, and warn contacts if your account may have sent the scam.