That Email Attachment Might Be a Trap: How to Spot Dangerous PDFs and Documents

That unexpected PDF or Word document might look harmless—especially when it comes from someone you know. But criminals can use attachments and document-sharing messages to send you to fake sign-in pages or deliver malicious files. Here is how to check safely, without needing to be a computer expert.

Why a familiar sender isn’t always safe

If someone gets into a person’s email account, they can send messages that appear to come from that real person. The name and email address may look completely normal. An unexpected invoice, shared document, church notice, or urgent form deserves a second look—even if you recognize the sender.

Five warning signs

• You weren’t expecting the file or the request.
• The message pressures you to open it immediately or keep it secret.
• A PDF or document says you must click a link and sign in to see the contents.
• The sign-in page has a strange web address or asks for your password unexpectedly.
• The attachment is an unusual file type, such as .exe, .js, or a password-protected ZIP you didn’t request.

These are clues, not proof. A legitimate file can ask you to sign in to a service, and a dangerous file can look ordinary. The safest approach is to verify the request independently.

How a fake PDF sign-in trick works

1. You receive an email with a PDF or document-sharing notification.
2. Opening the PDF may show a button such as “View document” or “Sign in to continue.”
3. The button takes you to a website that imitates Microsoft, Google, or another trusted service.
4. If you type your password there, the scammer may capture it. Some scams also try to collect verification codes.

Important: Merely viewing a PDF does not automatically mean your account has been hacked. In many phishing scams the real danger is following the link and entering your credentials. Malicious files can also exploit software vulnerabilities, so keep your PDF reader and operating system updated.

What to do before opening an unexpected attachment

1. Stop and check: Were you expecting this document?
2. Ask the sender another way: Call or send a fresh text using a number you already know—not a phone number in the suspicious message.
3. Go directly to the service: Open your usual Microsoft 365, Google Drive, Dropbox, or other app yourself rather than clicking the email’s sign-in link.
4. Don’t enable macros or bypass security warnings: A document asking for those actions is especially suspicious.
5. Report it: Use your email provider’s phishing-report option, or forward it to your workplace’s IT support using your organization’s reporting procedure.

What if you already clicked?

If you only opened a file: Close it, avoid any buttons inside it, update your software, and ask for help if you notice unusual behavior. Opening alone does not prove compromise.

If you entered your password: From the real website or app, change that password immediately, sign out of other sessions where available, turn on multifactor authentication, and review account activity. If it’s a work account, tell IT right away. If you reuse that password anywhere else, change it there too.

If you downloaded or ran something: Don’t run it again. Contact IT if it’s a work device; otherwise run your built-in security scan and get trusted technical help, especially if you installed software or granted remote access.

For more detailed next steps, read Clicked a Scam Link? What to Do Next or our guide to spotting scam emails.

Was your email account taken over? Read our hacked-email recovery checklist for hidden rules, forwarding and app access to check.

One simple rule to remember

Unexpected file + unexpected sign-in request = verify before you click. Even careful people can be fooled by a convincing message. Taking a moment to contact the sender through a separate, trusted channel can prevent a much bigger problem.