High riskEmail

eFax Document Email Scam

This scam emails a fake notification that a fax or scanned document has arrived for you, with a link or attachment to 'view' it that leads to a phishing login page or downloads malware.

Quick verdict

Risk level
High risk
Scam type
Notification-lure phishing
Main red flag
An email says a fax or scanned document is waiting and links or attaches it to view.
What to do first
Do not open it. Verify with the supposed sender through known contact details.

Understanding this scam

This scam emails a fake notification that a fax or scanned document has arrived for you, with a link or attachment to 'view' it that leads to a phishing login page or downloads malware.

Email scams, or phishing, remain one of the most common ways criminals steal logins, payment details, and money. A convincing message imitates a brand or contact and steers you toward a fake login page, a malicious attachment, or a fraudulent payment.

If you take one thing from this guide, make it this: An email says a fax or scanned document is waiting and links or attaches it to view. Do not open it. Verify with the supposed sender through known contact details.

If your message looks slightly different, check the Malware Attachment Scam or the Quarantined Email Scam, both are close cousins of this pattern. Every related guide lives in the Email Scams guides, and the scam checker can scan the text you received.

A typical example

Example pattern, not a real report
Example pattern: 'You have received a new document via scan-to-email. Click to view and download your file: [suspicious link]' or an attached 'Scan_4821.htm'.

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

The tell here: An email says a fax or scanned document is waiting and links or attaches it to view.

What the data shows

Most reported
phishing was the most common type of cybercrime complaint reported to the FBI in 2023
Source: FBI Internet Crime Complaint Center
$12.5B
total reported internet-crime losses in the US in 2023
Source: FBI Internet Crime Complaint Center

Warning signs

  • An unexpected fax or scanned document notification
  • A link or attachment to 'view' the document
  • A login page appearing when you try to open it
  • A sender unrelated to your office or contacts
  • Pressure that the document will be removed

Your safest response

  • Verify with the supposed sender using known contact details
  • Do not open attachments or links in unexpected notifications
  • Report the email as phishing and delete it
  • Run a security scan if you opened anything

If you have already engaged

  • If a login page appeared and you entered details, change that password
  • If you opened an attachment, run a security scan
  • Enable two-factor authentication on affected accounts
  • Update any reused passwords from a trusted device

What to avoid

  • Do not open 'scanned document' attachments from unknown senders
  • Do not enter logins to 'view' a document
  • Do not trust urgency to open it now

You might also see

High risk Email

Malware Attachment Scam

In a malware attachment scam, an email arrives with a file posing as an invoice, receipt, CV, statement or delivery note. Opening the attachment, or clicking a prompt to 'enable content' or 'enable macros', can quietly install malware that steals passwords, banking logins or files. The message is often crafted to feel urgent or routine so you act before thinking. Treating every unexpected attachment with caution, and verifying it through a separate channel, is one of the most effective defences.

Created by Scam or Safe Editorial Team
High risk Email

Quarantined Email Scam

This scam emails a warning that several messages are 'held in quarantine' or 'pending delivery' and asks you to log in to 'release' them, leading to a fake page that steals your email password.

Created by Scam or Safe Editorial Team
Medium risk Email

Fake Invoice Email Scam

This scam emails an invoice or receipt for something you did not buy, hoping you call a fake 'support' number or click a link to dispute it.

Created by Scam or Safe Editorial Team

Questions people ask

Are these document notifications real?
Scammers imitate scan-to-email and fax services to deliver phishing pages or malware. Verify with the supposed sender before opening anything.
Why does opening it ask me to log in?
The fake 'view' page is a credential trap. A genuine document would not require your email or account password to open.
I opened the attachment. What now?
Run a security scan, and if you entered details on a page that opened, change those passwords from a trusted device.
How can I tell it is fake?
Check whether the sender is someone you expect, and be wary of attachments and links. When unsure, confirm through known contact details.

Last reviewed June 2026 · Written & reviewed by the

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.