{"id":406883,"date":"2026-08-30T16:06:52","date_gmt":"2026-08-30T16:06:52","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=406883"},"modified":"2026-08-30T16:06:52","modified_gmt":"2026-08-30T16:06:52","slug":"fake-building-documents-email-scam","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/fake-building-documents-email-scam\/","title":{"rendered":"Fake Building Documents Email Steals Google Logins"},"content":{"rendered":"<p>A building changes owners, rent instructions are unsettled, contractors are everywhere, and urgent emails keep arriving. Then a familiar manager sends one more message with documents that are supposedly too large to attach.<\/p><div id=\"mwtad326033650\" class=\"mwtadhigh-1 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"7453445881\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>The request fits the moment so well that a shared Google Drive button can feel routine. The danger is hidden in the identity behind the message and the page that opens next.<\/p>\n<figure><img decoding=\"async\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" alt=\"Realistic reconstruction of a fake property management email offering building documents through Google Drive\" title=\"\" class=\"lazyload\" data-src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/building-documents-email.webp\"><\/figure>\n<div id=\"mwtad4236453899\" class=\"mwtadheader-1 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2917133959\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Overview<\/h2>\n<h3>The message borrows a real building crisis<\/h3>\n<p>A recent <a href=\"https:\/\/www.reddit.com\/r\/Scams\/comments\/1w11994\/usa_twist_on_evite_scam_in_oregon\/\" target=\"_blank\" rel=\"noopener\">consumer report<\/a> described a rental building that had just been sold. Residents were dealing with uncertainty about rent, disrupted services, construction, package theft, and vandalism.<\/p><div id=\"mwtad4273283521\" class=\"mwtadp1 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"1471373341\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>During that confusion, a family member received an email that appeared to come from the former management company and a known office manager. The message claimed important documents were too large for email and had to be retrieved from a Google folder.<\/p>\n<p>The recipient verified the request through a separate channel. The company said it was a scam. That independent check stopped the sender from controlling both the story and the supposed confirmation.<\/p>\n<h3>The Google Drive story makes the link feel normal<\/h3>\n<p>Property managers routinely share leases, notices, inspection records, sale documents, insurance files, and maintenance schedules. Cloud folders are ordinary business tools, and a large document can genuinely be too big for an email attachment.<\/p><div id=\"mwtad1812576251\" class=\"mwtadp2 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6935453015\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>The scam does not need to invent a bizarre event. It inserts one believable instruction into a real stream of building communications. A recipient who is waiting for new payment details or ownership documents has a reason to click quickly.<\/p>\n<p>The page may imitate Google Drive and ask the recipient to sign in. If the address is not a Google-controlled domain, the form can send the email address, password, and verification code to criminals.<\/p>\n<h3>The familiar sender may be spoofed or compromised<\/h3>\n<p>A known display name is not enough. The attacker may spoof the office manager&#8217;s name, register a lookalike domain, compromise a real mailbox, or reply inside an existing thread.<\/p><div id=\"mwtad2037066411\" class=\"mwtadp3 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5315249587\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p>A compromised account is especially dangerous because the message can pass normal email checks and contain real signatures, contact lists, or previous conversation details. The language may sound exactly like the person being impersonated.<\/p>\n<p>Before opening a property document, check:<\/p>\n<ul>\n<li>Was the file expected, and can the sender name the document clearly?<\/li>\n<li>Does the complete sender address match the management company&#8217;s known domain?<\/li>\n<li>Did the building recently change owners, payment instructions, or service providers?<\/li>\n<li>Does the button open drive.google.com or another domain?<\/li>\n<li>Does the page request a password after the account is already signed in?<\/li>\n<li>Can the office confirm the message using a phone number or portal used before the email arrived?<\/li>\n<li>Are new rent or banking instructions verified by both old and new management?<\/li>\n<\/ul>\n<figure><img decoding=\"async\" src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" alt=\"Realistic reconstruction of a fake Google login page for building documents on an unrelated domain\" title=\"\" class=\"lazyload\" data-src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/building-documents-fake-login.webp\"><\/figure>\n<div id=\"mwtad410057623\" class=\"mwtadheader-2 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9284335404\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Why This Spear-Phishing Story Is So Convincing<\/h2>\n<div id=\"mwtad761096202\" class=\"mwtadp4 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8735619847\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p>Mass phishing uses a story broad enough for thousands of recipients. Spear-phishing uses context. The attacker selects a target, studies a real event, and creates a request that belongs inside the victim&#8217;s current routine.<\/p>\n<p>A building sale creates several authentication problems at once. Residents may not know which company is responsible, whether old staff still have authority, where rent should go, or which email domains the new owner uses.<\/p>\n<p>Scammers can learn about a sale through public property records, real-estate listings, management announcements, social media, contractor signs, tenant discussions, or access to one compromised mailbox.<\/p>\n<div id=\"mwtad4268646154\" class=\"mwtadp5 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9971336976\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p>Operational disruption also reduces the value of unusual behavior as a warning sign. New addresses, new portals, new phone numbers, and unexpected documents may all be legitimate during a transition.<\/p>\n<p>The phrase \u201ctoo large to attach\u201d supplies a technical explanation for the link. It prevents the recipient from asking why the document is not simply included and creates a reason to use a cloud service.<\/p>\n<p>A real Google Drive invitation may arrive through Google, while a normal email can also contain a Drive link. That variety helps the scammer. Recipients do not have one familiar template against which every message can be compared.<\/p>\n<p>The decisive question is not whether Drive is a normal way to share files. It is whether this sender was authorized to share this specific file and whether the final page belongs to Google.<\/p>\n<div id=\"mwtad1150010211\" class=\"mwtadheader-3 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5345090394\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>How the Building Documents Google Drive Scam Works<\/h2>\n<h3>Step 1: The attacker identifies a period of change<\/h3>\n<p>A property sale, new management contract, renovation, rent portal migration, inspection, insurance update, or maintenance emergency creates a natural reason for residents to expect new instructions.<\/p>\n<p>The attacker may target one resident or send similar messages throughout a building. Even limited public information can make the email sound timely.<\/p>\n<h3>Step 2: A familiar office identity is copied<\/h3>\n<p>The message uses the name of a known manager, leasing agent, owners&#8217; association, or former management company. A copied signature and logo help the email blend with previous notices.<\/p>\n<p>The from address may change one letter, add a hyphen, use a free mailbox, or hide behind a display name. In a compromised-account version, the real address may be used.<\/p>\n<h3>Step 3: The email explains why the file is elsewhere<\/h3>\n<p>The sender claims the documents are too large for email, confidential, updated, or available only through a secure folder. The description may remain vague so every recipient imagines a file relevant to the building transition.<\/p>\n<p>Words such as \u201ckindly,\u201d \u201csecure,\u201d \u201cshared,\u201d and \u201cimportant\u201d can add a business tone, but polished language is not proof. The context is doing most of the persuasion.<\/p>\n<h3>Step 4: The button opens a Drive lookalike<\/h3>\n<p>The first page can display a blurred file preview, Google logo, folder list, or \u201csession expired\u201d notice. It then asks the visitor to sign in to view the building documents.<\/p>\n<p>The address bar may reveal an unrelated domain. A fake page can still use HTTPS and a padlock because encryption certificates are available to legitimate sites and criminals alike.<\/p>\n<h3>Step 5: Credentials and codes are captured<\/h3>\n<p>The victim enters a Google or Microsoft email address and password. The site may reject the first entry, request a one-time code, or ask the user to approve a login notification.<\/p>\n<p>A real-time phishing kit can pass those details to the legitimate provider immediately. This is why approving an unexpected prompt is dangerous even when multifactor authentication is enabled.<\/p>\n<h3>Step 6: The mailbox is used against the building<\/h3>\n<p>Once inside one resident&#8217;s or manager&#8217;s account, criminals can read discussions, collect leases, discover payment schedules, and send more convincing messages from a trusted address.<\/p>\n<p>The campaign may pivot from password theft to rent redirection. A later email can claim that the ownership transition requires a new bank account, payment app, wire destination, or portal.<\/p>\n<div id=\"mwtad2698360391\" class=\"mwtadheader-4 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5354318971\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>The Real Risks Go Beyond One Google Password<\/h2>\n<p>An email account often contains enough information to imitate both tenant and manager. Lease attachments reveal names, addresses, phone numbers, signatures, deposits, monthly rent, and renewal dates.<\/p>\n<p>Mailbox search can expose maintenance conversations, insurance documents, identification images, tax records, utility accounts, and messages about travel or vacancies. Those details support identity theft and more targeted social engineering.<\/p>\n<p>Criminals may create forwarding rules so new messages are copied silently. They can delete warnings, mark conversations as read, or monitor a payment change until the most profitable moment.<\/p>\n<p>If a management account is taken over, every resident becomes a possible target. A genuine internal address can distribute malicious folders or new payment instructions that are harder for spam filters to reject.<\/p>\n<p>Google says Workspace can automatically evaluate files shared from outside an organization for phishing or malware and may block suspicious content. That protection is valuable, but it does not make every file or external email safe.<\/p>\n<p>A fake site can also sit entirely outside Drive. The presence of a Google logo or folder image does not mean Google&#8217;s file-scanning systems ever saw the page.<\/p>\n<div id=\"mwtad2333492222\" class=\"mwtadheader-6-2 mwtadentity-placement\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2830607691\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>How Residents and Managers Can Verify a Transition<\/h2>\n<p>A building sale should create a documented communication plan. Residents need the legal name of the new owner, the effective date, the management company, the resident portal, and the approved payment methods.<\/p>\n<p>Management should repeat critical changes through more than one established channel. A portal notice, mailed notice, lobby posting, and known office phone number make a single compromised email less powerful.<\/p>\n<p>Residents should keep one recent statement or lease page containing verified contact details. When an unexpected message arrives, those details provide an independent route that the attacker did not choose.<\/p>\n<p>Any change to rent destination deserves a second-person check. Call the old manager and the new manager using previously verified numbers, then confirm the legal payee and effective date in writing.<\/p>\n<p>Managers can register lookalike domains defensively, configure SPF, DKIM, and DMARC, and train staff to expect callbacks for unusual requests. Those controls reduce impersonation but do not eliminate compromised-account risk.<\/p>\n<p>A resident reporting one suspicious message may protect the entire building. Management should issue a clear warning that names the false instruction without reproducing a clickable malicious link.<\/p>\n<p>If account takeover is suspected, the company should reset affected credentials, revoke sessions, review forwarding rules, preserve logs, and notify residents before sending replacement documents.<\/p>\n<p>The goal is not to make every cloud share difficult. It is to ensure that ownership, payment, and identity changes cannot be approved through one unverified email.<\/p>\n<p>Keep a building-specific incident log when suspicious notices circulate. Recording the sender, subject, time, claimed change, and official response helps staff connect reports without asking residents to reopen the malicious content.<\/p>\n<p>For high-risk changes, management can require residents to confirm inside the authenticated portal. An email may announce that a notice exists, but it should not be the only place where the new instruction can be viewed.<\/p>\n<div id=\"mwtad3934699152\" class=\"mwtadheader-6 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3648031192\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Company, Address, and Fulfillment Checks<\/h2>\n<h3>Confirm which management company currently has authority<\/h3>\n<p>During a sale, identify the legal owner, active manager, and date on which authority changes. Keep the last verified phone number, office address, resident portal, and company domain.<\/p>\n<p>Do not let a new email define its own legitimacy. Confirm the sender through contact details from the lease, an earlier statement, the resident portal, or a posted notice you already trust.<\/p>\n<h3>Compare the complete sender and reply-to addresses<\/h3>\n<p>Expand the message details. A display name can say \u201cBuilding Management Office\u201d while the actual mailbox belongs to a free service or a domain with a subtle spelling change.<\/p>\n<p>If the address is real but the request is unusual, call anyway. Compromised mailboxes can send fully authenticated phishing from the correct domain.<\/p>\n<h3>Inspect the final sharing and login domains<\/h3>\n<p>A Google Drive file normally uses a Google-controlled domain such as drive.google.com. A page that merely includes \u201cdrive,\u201d \u201cdocs,\u201d \u201cgoogle,\u201d or the building name elsewhere in the address may be unrelated.<\/p>\n<p>Do not sign in through a link when you can open drive.google.com independently and check Shared with me. A legitimate share should be visible through the real account environment.<\/p>\n<h3>Real fulfillment means a specific file exists<\/h3>\n<p>Ask the sender to name the document, explain why it is being shared, and confirm it through a separate channel. Vague phrases such as \u201cimportant documents\u201d protect the scammer from having to know what the recipient expects.<\/p>\n<p>If the office confirms no file was sent, there is nothing to retrieve. Preserve the email for reporting and do not keep testing the link.<\/p>\n<div id=\"mwtad3325854640\" class=\"mwtadheader-7 mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2944237110\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2>Warning Signs in a Property Management Email<\/h2>\n<ul>\n<li>The message arrives during a sale, renovation, payment change, or other period of confusion.<\/li>\n<li>A familiar display name hides an unfamiliar or slightly altered address.<\/li>\n<li>The reply-to address belongs to another domain.<\/li>\n<li>The document is described vaguely and supposedly cannot be attached.<\/li>\n<li>The button opens a non-Google domain with a Google-style page.<\/li>\n<li>The account appears signed in, yet the page demands the password again.<\/li>\n<li>The sender requests a code or login approval after the password.<\/li>\n<li>The email introduces new rent, deposit, wire, or portal instructions.<\/li>\n<li>The sender says there is no time to call the office.<\/li>\n<li>The message asks the tenant to keep the change confidential.<\/li>\n<li>Old and new management cannot independently confirm the same instruction.<\/li>\n<li>The file never appears in the real account&#8217;s Shared with me view.<\/li>\n<\/ul>\n<p>This story is more targeted than a generic document lure. MalwareTips&#8217; <a href=\"https:\/\/malwaretips.com\/blogs\/shared-document-available-for-your-review-email-scam\/\">shared document phishing guide<\/a> explains the mass-email version and the counterfeit login pages commonly used after the click.<\/p>\n<p>An older <a href=\"https:\/\/malwaretips.com\/blogs\/google-drive-file-is-pending-approval-scam-emails\/\">Google Drive pending-approval scam<\/a> uses a different pretext. Both campaigns rely on the same gap between a familiar cloud logo and the unrelated domain receiving the password.<\/p>\n<h2>What to Do if You Have Fallen Victim to This Scam<\/h2>\n<ol>\n<li><strong>Stop interacting with the message.<\/strong> Close the page, do not submit another password or code, and do not call any number included in the suspicious email.<\/li>\n<li><strong>Verify the office independently.<\/strong> Use a phone number from the lease, resident portal, previous statement, or official company website. Ask whether the employee sent the specific file.<\/li>\n<li><strong>Change exposed credentials.<\/strong> If a Google or Microsoft password was entered, change it from the provider&#8217;s known site or app. Replace the same password anywhere else it was reused.<\/li>\n<li><strong>Review account sessions.<\/strong> Remove unfamiliar devices, applications, passkeys, app passwords, and active sessions. Reject unexpected login approvals and regenerate backup codes if exposure is possible.<\/li>\n<li><strong>Inspect mailbox settings.<\/strong> Look for new forwarding addresses, filters, rules, delegates, deleted messages, sent mail, recovery details, and changed signatures. Remove anything you did not configure.<\/li>\n<li><strong>Check cloud storage activity.<\/strong> Review recent Drive or OneDrive files, shares, deleted items, and access history. Remove unknown collaborators and restrict sensitive building documents.<\/li>\n<li><strong>Freeze payment changes.<\/strong> Tell management that no new rent destination should be accepted until verified through two established channels. Ask neighbors or staff whether they received the same message.<\/li>\n<li><strong>Contact the bank if money moved.<\/strong> Use the number on the bank card or official app. Describe the transfer accurately, request recall or reversal immediately, and preserve the case number.<\/li>\n<li><strong>Report the abusive file or share.<\/strong> Google&#8217;s <a href=\"https:\/\/support.google.com\/docs\/answer\/2463296?hl=en\" target=\"_blank\" rel=\"noopener\">Drive reporting guidance<\/a> explains how to report abusive content and sharing notifications. Also mark the email as phishing.<\/li>\n<li><strong>Preserve evidence.<\/strong> Save the original email, headers, domain, screenshots, file name, payment instructions, account details, dates, and the real company&#8217;s denial. Do not rely only on a live page that may disappear.<\/li>\n<li><strong>Scan devices when files or software were opened.<\/strong> A login page primarily targets credentials. If an attachment, extension, installer, or macro-enabled document was opened, run a full Malwarebytes scan and remove unwanted software.<\/li>\n<li><strong>Block known malicious routes.<\/strong> AdGuard can reduce exposure to recognized phishing domains, malicious advertisements, and redirect chains. It cannot determine which manager has authority during a real property sale.<\/li>\n<li><strong>Report broader fraud.<\/strong> File a report at <a href=\"https:\/\/reportfraud.ftc.gov\/\" target=\"_blank\" rel=\"noopener\">ReportFraud.ftc.gov<\/a>. For financial loss, also contact local law enforcement and the payment provider using independently verified details.<\/li>\n<\/ol>\n<h2>Frequently Asked Questions<\/h2>\n<h3>Can a real management email account send a scam?<\/h3>\n<p>Yes. A compromised mailbox can send authenticated messages from the correct address and continue an existing thread. Verify unusual document and payment requests through another channel.<\/p>\n<h3>Are Google Drive sharing emails always safe?<\/h3>\n<p>No. Criminals can abuse real sharing services or imitate them on unrelated sites. Open the real Drive account independently and inspect Shared with me instead of trusting the email button.<\/p>\n<h3>Why do scammers say the documents are too large to attach?<\/h3>\n<p>The explanation makes a cloud link feel necessary. It also prevents the recipient from asking why the promised document is not included directly in the message.<\/p>\n<h3>What if I clicked but did not enter a password?<\/h3>\n<p>Close the page and remove unexpected downloads. The main credential risk begins when information is submitted, though any installed file, extension, or profile needs separate investigation.<\/p>\n<h3>Should I trust new rent instructions after a building sale?<\/h3>\n<p>Only after confirming them through established contact details and, ideally, with both the prior and new management. Never let the email supplying new bank details also supply the only verification method.<\/p>\n<h3>How can a tenant verify a shared document safely?<\/h3>\n<p>Call the office using a number already on record, ask for the exact file name, and open the cloud provider through its known site or app. A real share should appear there.<\/p>\n<h2>The Bottom Line<\/h2>\n<p>The fake building documents email succeeds by fitting a real situation. A property sale, familiar employee name, and ordinary Google Drive story can make the request feel expected.<\/p>\n<p>Break the attacker&#8217;s control over the conversation. Confirm the employee through an old, trusted channel and open Drive independently. If the document and sender are genuine, both checks will support the same story.<\/p>\n<div id=\"mwtad2621842976\" class=\"mwtadfinal mwtadentity-placement\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3077074880\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>A building changes owners, rent instructions are unsettled, contractors are everywhere, and urgent emails keep arriving. Then a familiar manager sends one more message with documents that are supposedly too large to attach. The request &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Fake Building Documents Email Steals Google Logins\" class=\"read-more button\" href=\"https:\/\/malwaretips.com\/blogs\/fake-building-documents-email-scam\/#more-406883\" aria-label=\"Read more about Fake Building Documents Email Steals Google Logins\">Read more<\/a><\/p>\n","protected":false},"author":51,"featured_media":406881,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49],"tags":[],"class_list":["post-406883","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scam-reports","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/406883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=406883"}],"version-history":[{"count":1,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/406883\/revisions"}],"predecessor-version":[{"id":407334,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/406883\/revisions\/407334"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/406881"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=406883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=406883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=406883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}