Suspicious Login Issues

How to Identify Fake OneDrive File-Sharing Emails Asking for Credentials

Ayan Masood Sep 25, 2026 868 views

Question details

The user received an unexpected email claiming to share a OneDrive file, which asks for login credentials to access the document, and needs to know if it is a scam.

How to Spot and Handle Fake OneDrive Sharing Emails Requesting Credentials

Product: Microsoft OneDrive / Outlook
Device & OS: not provided
Scenario: Receiving a suspicious file-sharing invitation via email that requires logging in.
Observed behavior: The email prompts the user to click a link and enter their login credentials to view the supposedly shared OneDrive file.

Before you start

Do not click on any links, open any attachments, or enter your login credentials. Treat the message as suspicious until you can independently verify its authenticity.

Solution 1Recommended

Inspect Internet Headers in Outlook

Check the hidden internet headers in Microsoft Outlook to reveal the true sender's email address and verify if the message actually came from Microsoft.

Email spoofing allows scammers to make an email look like it comes from a legitimate source, such as OneDrive. By inspecting the internet headers, you can see the actual routing information and the true origin of the message.

Open the email in a new window

Double-click the suspicious OneDrive sharing email in your Outlook inbox to open it in its own standalone window.

Navigate to Message Properties

Click on the 'File' tab in the top-left corner of the ribbon, select 'Info', and then click on the 'Properties' button.

Review the Internet headers

In the Properties dialog box, locate the 'Internet headers' text box at the bottom. Scroll through the text to find the 'Return-Path' or 'Authentication-Results' fields to see the actual email address of the sender.

Report as phishing

If the sender address does not match a legitimate Microsoft domain (such as @mail.onedrive.com), close the properties window, select the email in your inbox, and use the 'Report Phishing' button in Outlook to report and delete the scam.

Phishing Warning: Legitimate OneDrive sharing emails will usually allow you to view a public link without logging in, or they will direct you to a verified microsoft.com domain. They will never ask you to reply with your password.

Solution 2

Verify the Sharing Request Independently

Contact the supposed sender through a different, trusted communication method to confirm if they actually shared a file with you.

Free Microsoft Office alternative

Looking for a Secure, Lightweight Office Suite?

If you are concerned about cloud security and email scams tied to Microsoft Office accounts, consider trying WPS Office. It provides a secure, locally-installable, and highly compatible suite for creating and managing your documents without the hefty price tag or constant online account requirements.

1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded installer file and follow the simple on-screen instructions to set up the software.
3. Open your files securely: Launch WPS Office to securely open, edit, and save your existing documents without worrying about formatting loss.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight software that installs quickly and runs smoothly on older devices.Secure local file management with optional, built-in cloud sharing.Familiar user interface makes switching easy with zero learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

What should I do if I already clicked the link in the fake OneDrive email?

If you only clicked the link but didn't enter any information, run a full antivirus scan on your device immediately. If you entered your credentials on the fake login page, go directly to the official Microsoft website, change your password immediately, and enable two-factor authentication (2FA).

How can I tell a legitimate OneDrive sharing email from a fake one?

Legitimate OneDrive emails come from an official Microsoft domain (like @mail.onedrive.com). Hover over any links in the email without clicking; legitimate links will point to standard Microsoft domains (like onedrive.live.com or sharepoint.com). Fake emails often have typos, urgent language, or direct you to unfamiliar URLs.

Why do scammers send fake OneDrive file-sharing emails?

Scammers use the trusted name of OneDrive to trick users into a false sense of security. Their primary goal is 'credential harvesting'—stealing your email and password so they can access your accounts, steal sensitive data, or send more spam from your address.

Microsoft Office Security Issues