Treat PDF attachments as active documents

A PDF looks like a finished page, which is why it is such a convincing wrapper for scams. You open an invoice, a payslip, a delivery note, or a shared-document notice and it feels less changeable than an email. That feeling is useful for legitimate documents, but it can also make a fake message look more official than it deserves.

The important distinction is that a PDF is a document container, not a static image. It can hold page content, annotations, links, form fields, attachments, metadata, and instructions for the viewer. Modern readers place limits around many risky behaviours, but the file format still has active parts. Treating the attachment as inert is the mistake.

What can be active inside a PDF

A PDF can include embedded JavaScript. In ordinary business documents this is sometimes used for form calculations, date fields, or validation. In a suspicious attachment it can also be used to display prompts, try to open network resources, or guide you towards a next step. A current reader may block, ignore, or ask permission before running parts of it, but the request itself is a warning sign.

The format also supports actions. A URI action opens a web address. A launch action asks the viewer to open another file or application. Document-open actions can be attached to the moment the file loads, so the prompt appears before you have read the page. There are also actions tied to pages, annotations, and form buttons. The exact behaviour depends on the reader and its security settings, so do not assume that every viewer will handle the same file identically.

Embedded files are another source of confusion. A PDF can carry an attachment inside itself, much as an email can. The visible page may say that the embedded file is a statement, receipt, or secured document. Opening that second item is a separate decision; it should not inherit trust just because it was wrapped in a PDF.

Forms matter too. A PDF form can contain fields and a submit action that posts entered data to a remote server. That feature has legitimate uses in controlled workflows, but it is a poor fit for an unexpected attachment. If a document asks you to type account details, employee credentials, or a one-time code, stop and verify the workflow outside the file.

The common pattern is a link in a convincing wrapper

The more common danger is not a clever document exploit. It is a PDF that looks credible enough to make you click. A fake invoice may claim that a subscription has renewed and place the phone number or payment link in large type. A fake HR notice may say that a salary slip is masked until you verify your identity. A fake shared-document prompt may copy the language and colours of tools you use at work.

The PDF is the stage scenery. The real target is usually the next page: a form that asks for your email password, a payment screen, or a remote-support request. The attacker wants the document to feel routine so that you stop inspecting the path between the attachment and the website.

Brand logos prove very little. Logos are easy to copy, and page layout is easy to imitate. A plausible sender name proves little as well, because display names can be chosen freely and addresses can be made to look similar at a glance. The right question is not whether the page looks professional. The right question is whether the request fits a conversation you were already having.

What to inspect before you click

Start with the sender domain, not the display name. Expand the email details and read the actual address. A single extra word, a free-mail domain, or an unfamiliar country-code domain is enough reason to slow down. If the document claims to come from an employer, bank, letting agent, school, or supplier, compare the address with a message you already trust.

Then inspect the link target. Hovering may show the destination in a desktop mail client or browser, but copied links are more reliable when your tool shows the raw annotation target. Look for mismatched domains, shortened links, unusual spellings, and URLs that hide the important part after a long prefix. Do not sign in merely because the page after the click uses familiar colours.

Ask whether you expected the document. A real invoice normally matches a recent purchase, a known supplier, and a plausible amount. A real HR or tenancy document usually follows a conversation in a channel you already use. If the attachment is unexpected, verify it out of band. Use a phone number, chat thread, or portal you choose yourself, not the one printed in the suspicious PDF.

Safer handling for suspicious attachments

Open suspicious PDFs in a viewer with JavaScript disabled. Many desktop readers and browser viewers either disable PDF JavaScript by default or let you turn it off. If a document says you must enable content, allow a connection, open an embedded file, or install something before you can read it, treat that as a reason to stop rather than comply.

For inspection, prefer tools that work in your browser tab. The privacy scanner can help you examine document properties and hidden content without sending a possibly malicious attachment to a third-party converter. That matters because a suspect file can still contain personal information, supplier details, or internal names even if the message is fake.

If you need to make a safe copy for discussion, flattening can remove interactive layers by burning the visible page into a simpler output. Use the flatten PDF tool only after you have decided the visible content is safe enough to process; flattening is a containment step, not a cure for every hostile file. A PDF fingerprint is useful when you need to record exactly which attachment you received without forwarding it around.

A short checklist

• Treat unexpected PDFs as active documents until you have inspected them.
• Do not approve pop-ups, external connections, embedded files, or content enablement requests from an untrusted attachment.
• Check the real sender domain and the real link target before clicking.
• Verify invoices, HR notices, and shared-document prompts through a channel you selected yourself.
• Inspect suspicious files locally in the browser tab when possible, especially if the file may contain personal or business data.