Scam library · Email & phishing · Small business
Google Docs or Drive shared file phishing
You get a notification that someone shared a file: 'Invoice_2026.pdf', 'Updated contract' or 'Photos'. Sometimes it's from a person you know. Clicking opens a page that asks you to sign in to view the document.
The file may really be on Google Drive or OneDrive, which helps the email look legit. But the file or the next link leads to a fake login page.
What the message looks like
From: Google Drive <drive-shares-dm-noreply@google.com>
Subject: "Invoice_Nov_2026.pdf" shared with you
Mark Davis shared a file with you: Invoice_Nov_2026.pdf
Inside the PDF: "This document is protected. Click VIEW DOCUMENT and sign in with your email to access it." → docs-viewer-secure[.]com/login
How this scam works
Scammers often send these from hacked accounts of real contacts, so the name is familiar. The shared file is usually a one-page PDF with a 'View Document' button that takes you elsewhere.
Sometimes the shared document is a full scam letter with a phone number or a fake order. Other versions use a comment mention: 'Ann mentioned you in a comment' with a link inside.
The aim is your email password. Once scammers are in, they send the same trick to everyone in your contacts, and they look for payment conversations to hijack.
Red flags
- A shared file you weren't expecting, especially an invoice or contract.
- A file that just contains a button or link to 'view' the real document.
- A login page that isn't on google.com, microsoft.com or the real service.
- A familiar sender who doesn't usually share files with you.
- Odd file names or a generic message.
How to tell it’s fake
- Ask the sender, by phone or a new message, whether they shared it.
- Open Google Drive or OneDrive yourself and look in 'Shared with me'.
- Check the address bar before signing in anywhere.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you didn't type anything, close the page. Report the file with Google's 'Report abuse' option, or tell your IT team.
If you paid
- If the document asked you to pay something, don't. Contact the company through a number you trust.
If you shared personal info, a password or a code
- If you entered your password, change it immediately, enable two-step verification and review recent account activity and forwarding rules.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard in Chrome or Edge on your computer looks at shared-file notices you have open in Gmail or Outlook on the web and the pages they open. It notices when a 'document viewer' asks for your email password on a non-Google, non-Microsoft address and warns you first. If a share from a colleague seems legit but unexpected, a quick check saves a lot of trouble.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Can a real Google Drive share be a scam?
- Yes. Anyone can share a file from a real account. The scam is what's inside the file.
- Why would a friend send me this?
- Their account was probably hacked. Let them know through another channel.
- I opened the PDF but didn't click. Am I safe?
- In most cases, yes. Opening is lower risk; typing a password is what gives access.