Document Shared with You Scams
Messages contain a notice that someone shared a document with you
This scam takes advantage of the ability to share documents via cloud file-sharing services like OneDrive and Google Drive. In most cases, the files are shared from a compromised account belonging to another organization. However, the scammer uses the notification comments field in an attempt to make the file share look as if the share is from someone you might know - your boss, an executive leader, or the President.
Messages typically contain links to important-sounding documents
The shared file will have an important-sounding name - often involving payroll, salary, bonuses, evaluations, or benefits. Here are some real examples:
- Spring Faculty Reward & Recognition.docx
- Faculty & Staff Merit.pdf
- Eastern Washington University Payroll Update
- Eastern Washington University Appointment Notice
- September 2025 Staff Reports & Updated Athletic Directory
Messages can be identified
An easy way to spot one of the scam messages is that it will typically contain references to multiple people or "senders". If there are any references to a sender name that your don't recognize or an email address that does not belong to EWU, that's a red flag.
If you receive a shared document email, ask yourself:
- Is there only one sender account and it is someone I know and trust?
- Is the shared file something I was expecting to receive?
- Is the shared file something that would normally be shared by the sender?
If the answer to any of these questions is NO, do not click on links or open attachments.
Never enter your username/email and password into a form after clicking on a document shared with you.
Messages should be reported
Please report suspicious messages to infosecurity@ewu.edu so we can take action if needed
Example Message
