A message says someone shared an invoice, project plan, or family photo with you. The sender’s name and familiar-looking logo may make the alert seem routine, but neither proves who sent it. If you weren’t expecting the file, pause before clicking, downloading, or signing in. You can check whether the share is genuine without using the notification’s link: contact the supposed sender through details you already trust and ask them to confirm the file and sharing method. If you cannot confirm it, treat the alert as unverified and leave it alone.
The useful bits
- Verify the share with the supposed sender using a contact method you already know.
- Do not enter a password or one-time code on a page reached from an unexpected alert.
- Treat branding, display names, and file names as clues—not proof of origin.
Pause before interacting
Do not click the file, preview, or sign-in button while you are deciding whether the alert is real. Avoid downloading an attachment or replying with personal information. A message can look polished and still come from an unexpected or misleading source; its logo, colors, and display name do not establish who sent it.
Read the notification without treating its claims as verified. Ask yourself whether you were expecting a file, whether the named person would normally share it this way, and whether the timing makes sense. An unexpected alert is a reason to check, not proof that an account has been compromised.
Verify through a separate, known channel
Contact the person who supposedly shared the file using details you already have, such as a saved phone number or an established conversation in a separate account. Do not rely on a phone number, email address, or reply button supplied only by the alert. If you know the person in a workplace context, use your usual contact method rather than a new link in the message.
Ask a specific question: did you share a file with me, what is its name, and which service did you use? If the answer is unclear, or the person says they did not send it, do not proceed. If you cannot reach them, wait until you can verify. Urgency in the alert does not make a link safer.
Unexpected alert: “Jordan shared Q3 invoice—view now.” Safer check: Contact Jordan using a saved number or an existing conversation. Ask whether they shared a file called “Q3 invoice” and which service they used. If Jordan did not share it, do not open the link or enter any account details.
Keep credentials away from unfamiliar pages
A request to sign in is not proof that the file is legitimate. If you followed a link before noticing the warning signs, do not type your password, one-time code, or recovery information into a page you do not recognize. Close the page. Do not use a search result or the alert’s branding alone to decide that a page belongs to the service it claims to represent.
If the sender independently confirms the share, use a route you already know to reach the relevant service, rather than returning through the alert. If you still cannot establish that the sign-in page is the correct one, stop and ask the sender to confirm the process or provide the file through a method you already trust.
Look at the details without trusting them as proof
Check the sender address and the file name for mismatches, odd wording, or a request that does not fit the situation. These details can help you decide what to ask, but a familiar name or plausible address is not conclusive. Likewise, a convincing logo or professional layout does not verify the source.
Be cautious if the alert pushes you to act immediately, asks you to enable something unexpected, or requests information unrelated to receiving a file. Do not try to investigate by opening the attachment or testing the link. Independent confirmation is safer than interacting with a suspicious message.
If you already clicked or entered information
If you opened a page but entered nothing, close it and do not continue through prompts. If you entered a password or one-time code, use the service’s independently reached account-recovery or security process promptly; do not go back through the alert. If the account belongs to work, notify the appropriate administrator or support contact using your normal channel.
If you downloaded a file, do not open it just to see what it contains. Follow the security process used by your organization, if applicable. Avoid forwarding the suspicious alert to others as though it were confirmed; if you need to report it, use the mail or service’s established reporting option, when available.
A quick check before you move on
Before acting, make sure you can answer these questions: Have I confirmed the share with the person through contact details I already trust? Do I know what file they shared and which service they used? Am I avoiding the alert’s sign-in link and keeping passwords and codes out of unfamiliar pages? If any answer is no, leave the file unopened and wait for confirmation.
You have confirmed the alert only when the supposed sender independently verifies the share and its relevant details. That confirmation does not make every link or attachment automatically safe; continue to use the service through a route you recognize and stop if the page or request does not match what was confirmed.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction