Fake SharePoint and OneDrive File Sharing Emails｜How to Check Before Opening Documents
“A file has been shared with you” is one of the most normal messages in office work.
That is exactly why attackers use it.
A phishing email can pretend to be a SharePoint or OneDrive sharing notification and push you to open a file, sign in again, or approve access without thinking too much about it.
The message may say:
“John shared a document with you.”
“Review the updated contract.”
“Open the secure file in OneDrive.”
“A confidential document is waiting.”
At first glance, it can look legitimate.
But before you open the document, it helps to slow down and check a few things first.
The goal is simple:
Do not trust the sharing email just because it looks like Microsoft 365. Verify the sender, the link, and the file context first.
1. Why fake file-sharing emails work so well
These emails work because they match real office behavior.
Most people already receive:
SharePoint file links
OneDrive sharing notifications
Teams file messages
document review requests
folder access notices
collaboration invites
That makes a fake message feel familiar.
A phishing email does not need to look perfect.
It only needs to look normal enough for someone to click quickly.
That is why file-sharing scams are common in workplaces.
2. Check the sender address, not just the sender name
The first thing to check is the sender.
Do not stop at the display name.
A message might say:
Microsoft SharePoint
OneDrive Notification
Internal Documents
HR Team
Project Files
But the real sender address may tell a different story.
Look for warning signs like:
a random external domain
a misspelled company name
extra words like secure, verify, update, or login
an address that does not match the person who supposedly shared the file
For example, if your coworker usually emails from your company domain, but the file-sharing email comes from a strange outside domain, that is a red flag.
A simple question helps here:
Does the sender address match the person or organization it claims to be?
If not, do not open the file yet.
3. Ask whether you were expecting this file
Even a real-looking email can be suspicious if the context does not make sense.
Before clicking, ask:
Was I expecting this file?
Do I know this sender?
Does the file name make sense?
Am I part of this project?
Would this person normally share documents with me?
Is the message too vague?
Be careful with generic file names like:
Updated Document
Secure File
Review Copy
Invoice Attached
Confidential Report
Shared Folder
Real collaboration messages usually have more context.
If the email feels vague, random, or unrelated to your work, treat it carefully.
4. Hover over the link before clicking
A fake SharePoint or OneDrive email often hides a suspicious link behind a normal-looking button.
The button might say:
Open
View Document
Open in OneDrive
Review File
Access Shared Folder
Before clicking, hover over the link and check where it really goes.
Be careful if the destination:
does not match Microsoft or your company
uses a strange shortened link
sends you to an unfamiliar login page
includes odd spelling or extra words
looks unrelated to SharePoint or OneDrive
The most important rule is:
If the link destination does not match the message, do not click it.
5. Open SharePoint or OneDrive directly instead
One of the safest habits is to avoid opening a file from the email first.
If the message says a file was shared with you, open Microsoft 365 directly instead.
For example:
open OneDrive directly
open SharePoint directly
check the shared files section
check Teams if the file came from a teammate
ask the sender in a separate message
This works because a real shared file should usually be visible inside the official app or portal.
If the file only exists through a suspicious email link, that is a warning sign.
A safer workflow is:
Email arrives → do not click yet → open OneDrive or SharePoint directly → check whether the file is really there
6. Be careful when the email asks you to sign in again
A common phishing trick is using a fake login page.
You click what looks like a file-sharing link, then you land on a page asking you to sign in.
That page may look like Microsoft, but the real goal is to steal your login details.
Be careful if:
you are asked to sign in again for no clear reason
the page opens from a strange domain
the login page looks slightly off
the message creates urgency
the page asks for extra verification unexpectedly
If you are not sure, close the page.
Then open Microsoft 365 from your usual bookmark, browser, or official app.
Never trust a login prompt just because it looks familiar.
7. Watch for pressure, secrecy, and urgency
Phishing emails often try to push you into acting fast.
A fake SharePoint or OneDrive email may say:
“Open immediately.”
“Your access will expire.”
“Urgent review required.”
“Confidential file — do not delay.”
“Action needed today.”
That does not automatically mean the email is fake, but urgency is a common warning sign.
The more the email tries to rush you, the more carefully you should verify it.
8. Quick checklist before opening a shared document
Before opening a SharePoint or OneDrive file from email, run through this checklist.
1. Sender
Does the sender address look real?
2. Context
Was I expecting this file?
3. File name
Does the file name make sense?
4. Link preview
Does the link go to a trusted Microsoft or company domain?
5. Login request
Is the message asking me to sign in again?
6. Urgency
Is the email pressuring me to act quickly?
7. Verification
Can I find the same file in OneDrive, SharePoint, or Teams directly?
If two or more of these feel wrong, stop and verify before opening anything.
9. What to do if you already clicked
If you already clicked a suspicious link, do not panic.
But do act quickly.
Here is a simple response:
Close the page
Do not enter your password
If you entered your password, change it from the official Microsoft 365 portal
Report the email to IT or your security team
Check your account activity if available
Keep the original email for review
Watch for unusual activity in Outlook, OneDrive, SharePoint, or Teams
If this is a work account, report it even if you are not sure anything happened.
Final thoughts: do not trust the file-sharing email alone
A fake SharePoint or OneDrive email can look very normal because real file-sharing messages are part of everyday work.
That is why the safest habit is simple:
Check the sender, check the context, check the link, and verify the file in Microsoft 365 directly before opening it.
When in doubt, do not open the document from the email.
Open SharePoint, OneDrive, or Teams yourself and confirm the file there first.
That one extra step can prevent fake logins, stolen passwords, and a lot of unnecessary security trouble.
