High riskEmail Scams

eFax Document Email Scam

This scam emails a fake notification that a fax or scanned document has arrived for you, with a link or attachment to 'view' it that leads to a phishing login page or downloads malware.

Quick verdict

Risk level
High risk
Scam type
Notification-lure phishing
Main red flag
An email says a fax or scanned document is waiting and links or attaches it to view.
What to do first
Do not open it. Verify with the supposed sender through known contact details.

What this scam usually looks like

This scam emails a fake notification that a fax or scanned document has arrived for you, with a link or attachment to 'view' it that leads to a phishing login page or downloads malware.

Example message pattern

Example pattern — not a real report
Example pattern: 'You have received a new document via scan-to-email. Click to view and download your file: [suspicious link]' or an attached 'Scan_4821.htm'.

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

Red flags to watch for

  • An unexpected fax or scanned document notification
  • A link or attachment to 'view' the document
  • A login page appearing when you try to open it
  • A sender unrelated to your office or contacts
  • Pressure that the document will be removed

What to do

  • Verify with the supposed sender using known contact details
  • Do not open attachments or links in unexpected notifications
  • Report the email as phishing and delete it
  • Run a security scan if you opened anything

If you already clicked or replied

  • If a login page appeared and you entered details, change that password
  • If you opened an attachment, run a security scan
  • Enable two-factor authentication on affected accounts
  • Update any reused passwords from a trusted device

What not to do

  • Do not open 'scanned document' attachments from unknown senders
  • Do not enter logins to 'view' a document
  • Do not trust urgency to open it now

Similar scams

High risk Email

Malware Attachment Scam

In a malware attachment scam, an email arrives with a file posing as an invoice, receipt, CV, statement or delivery note. Opening the attachment, or clicking a prompt to 'enable content' or 'enable macros', can quietly install malware that steals passwords, banking logins or files. The message is often crafted to feel urgent or routine so you act before thinking. Treating every unexpected attachment with caution, and verifying it through a separate channel, is one of the most effective defences.
High risk Email

Quarantined Email Scam

This scam emails a warning that several messages are 'held in quarantine' or 'pending delivery' and asks you to log in to 'release' them, leading to a fake page that steals your email password.
Medium risk Email

Fake Invoice Email Scam

This scam emails an invoice or receipt for something you did not buy, hoping you call a fake 'support' number or click a link to dispute it.

Frequently asked questions

Are these document notifications real?
Scammers imitate scan-to-email and fax services to deliver phishing pages or malware. Verify with the supposed sender before opening anything.
Why does opening it ask me to log in?
The fake 'view' page is a credential trap. A genuine document would not require your email or account password to open.
I opened the attachment. What now?
Run a security scan, and if you entered details on a page that opened, change those passwords from a trusted device.
How can I tell it is fake?
Check whether the sender is someone you expect, and be wary of attachments and links. When unsure, confirm through known contact details.

Last reviewed: June 2026

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.