Unexpected cloud file-sharing messages can look routine while leading to credential theft, malware, or unauthorized access. This checklist explains how to verify Google Drive, Dropbox, and OneDrive links safely, what warning signs to track, and what to do if you already clicked.
Overview
A file-sharing scam uses the familiarity of cloud storage to make an unsafe request seem trustworthy. The message may claim that someone shared an invoice, contract, document, password-protected archive, or “urgent” file with you. It may arrive by email, text message, workplace chat, or a QR code posted in a document or physical location.
A legitimate-looking logo is not proof that a message is genuine. Attackers can copy branding, display names, notification layouts, and familiar language. A link may also open a real cloud service first and then redirect to a fake login page. Treat the message, link, and destination as separate things to verify.
The safest default is simple: do not use the message’s link to investigate the message. Instead, open the cloud provider through a bookmark, a known application, or a manually entered address. Then check whether the shared file or notification appears in your account. If the message concerns work, confirm it with the supposed sender through a separate channel.
What to track
1. Sender identity and context
Check the complete sender address rather than relying on the visible name. Look for misspellings, unexpected domains, unusual subdomains, extra words, or a personal address where a business or colleague normally uses an organizational account. A familiar name can also be spoofed or copied.
Ask whether you were expecting the file. An unexpected message that creates pressure, secrecy, or confusion deserves additional verification. Be especially cautious when the message says your account will be closed, a payment is overdue, a document must be signed immediately, or a security problem requires you to log in.
2. The destination URL
Before opening a link, inspect its destination. On a computer, hover over it without clicking. On a mobile device, press and hold if the operating system shows a preview. Expand shortened links only with a method you trust, and do not paste confidential information into an unfamiliar URL-checking service.
Read the domain from right to left. The important part is the registered domain, not a cloud provider’s name placed in a subdomain or a long path. Be cautious with lookalike spelling, added hyphens, unfamiliar top-level domains, and addresses that contain a provider’s name but end in an unrelated domain. HTTPS encrypts a connection; it does not prove that the site is legitimate.
3. The sign-in request
A fake Google Drive email, Dropbox phishing link, or OneDrive phishing page may reproduce the appearance of a familiar login screen. Stop if the address bar does not show the provider or your organization’s recognized sign-in domain. Do not enter a password to “preview” a file, remove a sharing restriction, or resolve an account warning.
Unexpected requests for one-time codes, recovery codes, security keys, or approval prompts are also warning signs. Never read a verification code to someone who contacted you unexpectedly, and do not approve a sign-in notification you did not initiate.
4. Attachments, QR codes, and file behavior
A shared-file scam may include an attachment instead of a direct link. Treat HTML files, unexpected archives, scripts, macros, and password-protected files with care. A password supplied in the same message does not make an attachment safe.
QR codes can hide the destination from view and are a common variation of a QR code phishing scam. Scan only when you can preview the address and verify the context. If a QR code opens a login page, close it and access the service through its official application or a known bookmark instead.
5. The request after the click
Track what the page asks you to do. Requests to download a “viewer,” install a browser extension, disable security controls, call an unfamiliar support number, or provide payment and identity information should be treated as high risk. A file-sharing service should not need your cloud password in an unrelated form to show you a document.
Cadence and checkpoints
Use a short verification routine every time an unexpected cloud notification arrives. First, pause and identify the requested action. Second, inspect the sender and destination without opening the link. Third, verify the event through the provider’s official application or website. Fourth, confirm the file with the supposed sender using a separate contact method. Only then decide whether to open or download it.
For teams, review shared-file settings and external-link activity on a regular monthly or quarterly cadence, depending on the sensitivity and volume of the work. Look for old public links, external collaborators who no longer need access, unusual sharing invitations, and files that have been copied into unfamiliar locations. Keep this review separate from the act of responding to a suspicious message; an urgent email should not determine your normal access process.
Maintain a simple incident record when a message appears suspicious. Note the date, sender address, subject, destination domain, delivery channel, and whether anyone clicked, downloaded, entered credentials, or approved a prompt. Do not forward the original message widely if doing so could expose a dangerous link. Use your organization’s reporting process or the cloud provider’s available reporting controls.
If you clicked, act quickly but calmly. Close the page, disconnect a device from the network if a suspicious download or program ran, and contact your IT or security team. From a known-clean device, change the affected password and any reused passwords, review active sessions and connected applications, and check account recovery details. Revoke unfamiliar sessions, app access, and shared links where appropriate. The guide on revoking cloud sessions, app access, and shared links provides a focused follow-up checklist.
If a file was deleted, overwritten, encrypted, or moved after an account incident, preserve evidence before making broad changes. Check trash or recycle-bin locations, version history, activity logs, and administrator recovery options. A practical starting point is the cloud file recovery checklist.
How to interpret changes
One warning sign may be an innocent formatting error. Several independent warning signs are more meaningful: an unexpected request, a mismatched sender domain, a suspicious destination, urgency, and a demand for credentials. Do not score a message by appearance alone. A polished email can still be unsafe, while a poorly formatted message may simply be a legitimate notification.
Pay attention to changes in normal patterns. A sudden increase in external sharing invitations, repeated login prompts, new applications connected to an account, or access from an unfamiliar context may indicate either a campaign or an account problem. These signals are not proof by themselves, but they justify verification and, for managed environments, escalation to an administrator.
Also distinguish synchronization from backup. A synced folder can reproduce deletions, corruption, or encrypted files across devices. For important data, use a recovery approach that includes version history, retention controls, or an independent backup rather than relying on synchronization alone. Review the cloud storage security checklist for broader controls around shared files and external links.
When to revisit
Revisit this checklist monthly or quarterly, and immediately after a security incident, a major change to your cloud provider, or the introduction of a new collaboration tool. Update your trusted bookmarks, approved domains, reporting route, and recovery contacts. Teams should also refresh the process when staff roles change or external collaboration expands.
Make the next review practical: test that users know how to report a suspicious message, remove unnecessary shared links, confirm that multifactor authentication methods and recovery details are current, and verify that important files have a realistic recovery path. If you already clicked a suspicious link, do not wait for the next scheduled review. Start account takeover recovery now, preserve relevant evidence, and ask your administrator or provider for help.
The goal is not to identify every scam from its design. It is to slow down risky decisions, verify through a trusted path, limit access, and recover safely when something goes wrong.
