1
It is how we work
Share notifications arrive all day, so an extra one hardly gets a second look.
How it showed up hereA notice that looks like the many real ones you get.
Fake File Shares & Cloud Storage Notices
This short course is required for everyone at Charitybuzz. It takes about ten minutes: a few focused lessons, a quick quiz, and a confirmation that goes on your training record. Everything in it comes from the kinds of messages and requests our team is actually receiving, so what you learn here is what you will use at work.
What this covers How fake file-sharing notices lure you into a fake sign-in page, and how to open shared files safely.
What this is about
Sharing files is how Charitybuzz works: lot descriptions, consignment paperwork, payout spreadsheets, partner agreements. Everyone expects "X shared a document with you" messages, which is exactly why attackers copy them.
The fake version looks like a Google Drive, Docs or Sheets share, or a Dropbox or OneDrive notice. The button leads to a page that asks you to sign in again to view the file. Anything you type goes straight to the attacker. A recent example at Charitybuzz was a fake "shared a spreadsheet" message from an outside address that carried Gmail's yellow External label.
Spot the signs
Quick check: for each item, decide whether it is a red flag or looks fine. Real Google files open on docs.google.com or drive.google.com.
0 of 6 answered
https://docs.google.com/spreadsheets/d/1AbC…/editThe owner of the address is google.com, and "docs" is Google's own document site.
https://docs.google.com.shared-files.net/view/payout-sheetThe real owner is shared-files.net. "docs.google.com" is just a name the attacker put at the front.
Sender: "Google Docs" <[email protected]>The display name says Google, but the address is gdocs-share.co, which has nothing to do with Google.
A share from an address with Gmail's yellow "External" label, claiming to be People OperationsThe External label means the sender is outside Charitybuzz. A real internal share would not carry it.
A Google Drive notification you expected, from a colleague, with no "External" labelYou were expecting it, it comes from inside Charitybuzz, and you can open Drive yourself to confirm.
A page that asks you to sign in again to "view the document" after you click the buttonIf you were already signed in, a real file simply opens. A second sign-in is the trap.
Why this works on smart people
2
Curiosity and worry
File names are chosen to make you want to open them.
How it showed up hereNames like "Performance Evaluation", "Payroll", "Bonus", "Invoice".
3
Authority
The notice appears to come from a department such as HR or Finance.
How it showed up here"People Operations has invited you to edit".
4
The sign-in step feels normal
We get asked to sign in to Google all the time, so doing it once more does not feel odd.
How it showed up hereA fake page that copies the real sign-in box.
How this lands at Charitybuzz
The fake shares aimed at us usually look like one of these:
Everyone
The HR-themed share
A message appears to come from an internal department and shares a spreadsheet or document with a title about performance, pay or bonuses, asking you to open and edit it.
The tell
It carries the External label or comes from an address that is not @charitybuzz.com, and you were not expecting it.The right move
Do not click. Ask the team on Slack whether they shared it, and report the message.Finance & Operations
The partner paperwork share
A person claiming to be from a nonprofit partner or consignor shares a "revised payout form" or "updated banking details" through a cloud link.
The tell
Changed banking details are a classic scam. The notice may come from a real-looking name but an unfamiliar address.The right move
Confirm with your contact using a phone number you already had before opening or acting on anything.Customer Experience & Partnerships
The "storage full" warning
A message claims your Google, Dropbox or OneDrive storage is full or your files will be deleted unless you sign in or pay.
The tell
Real storage notices can be checked inside your account, and they do not threaten deletion within hours.The right move
Check storage yourself at drive.google.com (or the service's own site). Report the message.Red flags to watch for
The External label
It marks mail from outside Charitybuzz.
A sender that is not a Google address
Real Google share notices come from google.com addresses. The display name alone proves nothing.
A sign-in page after you click
Real shared files open in your already signed-in browser.
A file you were not expecting
Especially about pay, performance, invoices or legal matters.
A mismatch between the subject and the body
For example a calendar invitation subject on a spreadsheet notice, or random codes in the subject.
A link whose address is not google.com, dropbox.com or microsoft.com
Hover over the button to see where it really goes.
Threats to delete files or close your account
Used to make you rush.
A request to "enable editing" or "enable content"
Applies to downloaded files and can run malicious code.
A real share
- Comes from a colleague you recognize, or one you expected
- Appears in "Shared with me" in Drive
- Opens without asking you to sign in again
- Has no External label for internal colleagues
- Names a file that matches the context
A fake share
- Comes from an outside address, often with a company name in the display name
- Pushes you to its own button or link
- Asks you to sign in to view
- Names a tempting file you were not expecting
- Has mismatched or odd details
What to do instead
Look at who it is really from
Check the address, not the name. Internal shares come from @charitybuzz.com, and the External label means they do not.
Open the file the safe way
Go to drive.google.com yourself and look in Shared with me. If it is not there, it is not real.
Hover before you click
On a computer, hover over the button to see the real destination. On a phone, press and hold the link.
Ask the person
DM the sender on Slack, or call them, to ask if they shared it.
Never sign in again to "view" something
If asked, stop and report.
Report it
Use Gmail's Report phishing and tell John.
If you clicked — or entered something
Signed in on a page that opened from the link? Change your password immediately
Do it from myaccount.google.com, then review Your devices and sign out anything unfamiliar.
Opened a file and clicked "Enable editing/content"? Tell John right away
Do not keep using that device until IT has checked it.
Report it — even if you think you got away with it
In Gmail, open the message, click the ⋮ menu and choose Report phishing. Then email [email protected] with a one-line summary of what you did (clicked, opened a file, typed a password, approved a prompt). Fast reports let IT block the sender for everyone.
Typed your password? Change it now
From a device you trust, go to myaccount.google.com by typing it yourself, change your password, and review Security → Your devices. If you reuse that password anywhere else, change it there too.
Approved a sign-in prompt or read out a code? Call IT immediately
This is the most urgent case: the attacker may already be in your account. Contact Charitybuzz IT ([email protected]) right away so they can end every session and reset access.
Opened an attachment or installed something? Stop and tell IT
Don't keep working on that device and don't try to "clean it up" yourself. Leave it on, disconnect it from Wi‑Fi if you can, and contact IT.
Key takeaways
- Real shared files open in Drive. If a "share" asks you to sign in again, it is fake.
- The External label means the sender is outside Charitybuzz, whatever name they use.
- Check "Shared with me" in Drive yourself rather than using the button.
- Be extra careful with files about pay, performance, invoices and banking.
- When unsure, ask the sender on Slack and report the message.
Knowledge check
Confirm your training record
This creates the completion record Charitybuzz keeps for compliance. Please use your work details.
Training complete
Your completion has been recorded. Thank you for helping keep Charitybuzz, our nonprofit partners, and our bidders safe.
Certificate ID: —
View & print certificateKeep this handy
- Real shared files open in Drive. If a "share" asks you to sign in again, it is fake.
- The External label means the sender is outside Charitybuzz, whatever name they use.
- Check "Shared with me" in Drive yourself rather than using the button.
- Be extra careful with files about pay, performance, invoices and banking.
- When unsure, ask the sender on Slack and report the message.