Fake WeTransfer download emails: how to check a transfer before you open it

"You have received 3 files via WeTransfer. Download before they expire." File transfer notices are routine for designers, agencies, law firms, builders and anyone who swaps large files, which is exactly why criminals copy them. A fake WeTransfer email can lead to a fake sign-in page or a malware download; a real transfer from a scammer can carry malware or a phone scam. This guide shows how to tell which you're looking at and what to do if you already clicked.

What is fake WeTransfer phishing?

Fake WeTransfer phishing is any email that uses WeTransfer's name or service to trick you into giving up a password, running malware or calling a scammer. WeTransfer's own help article, updated in October 2026, splits it into two types:

1. A fake email or website pretending to be WeTransfer. WeTransfer says "Some scammers don't use WeTransfer at all." They copy its branding to steal information or push a malware download.
2. A real WeTransfer transfer containing malicious or deceptive files. The transfer genuinely comes through WeTransfer, "but the sender is attempting to trick you into opening harmful files or sharing sensitive information."

Knowing which type you have tells you what to check. Our wider guide to file-sharing notification phishing covers the same pattern for OneDrive, SharePoint, Google Drive and Dropbox.

Example of a fake WeTransfer email

This is an example written for this guide. It is not a real WeTransfer email.

From: WeTransfer <noreply@wetransfer-files.net>
To: undisclosed-recipients
Subject: someone sent you files via WeTransfer Pro

someone sent you 4 files (2.3 MB)

  Signed_Contract_Final.pdf
  Remittance_Advice_Q4.pdf
  + 2 more

Files expire in 24 hours.

[ Download files ]

To protect your files, please sign in with your
business email account before downloading.

Almost every line is a red flag WeTransfer names: a sender that isn't @wetransfer.com, "undisclosed recipients", a sender shown as "someone", a mention of WeTransfer Pro, and a request to sign in elsewhere before downloading.

How do I know if a WeTransfer email is real?

Hover over the download button before you click. WeTransfer says that if it leads anywhere other than wetransfer.com or we.tl, you shouldn't click it. Then work through the rest of WeTransfer's checklist (WeTransfer Help):

1. Sender address. Was it sent from an address that doesn't end in @wetransfer.com? WeTransfer notes that support replies may come from @wetransfer.zendesk.com and that "some marketing emails use other verified domains."
2. Recipients. "Genuine transfer notifications are sent directly to the recipient's email address." A message to undisclosed recipients or to someone else's address is suspect.
3. Sender shown. Does it call the sender "someone", or show no sender at all?
4. Product names. Does it mention WeTransfer Plus or Pro? WeTransfer says its subscription "has not been called that for years."
5. Extra steps. Does it ask you to visit another website before you can download?
6. Look and language. Spelling errors, odd sentences or formatting unlike the WeTransfer emails you normally get.

If any check fails, don't click or download. If you're expecting files, ask the sender to share them again or confirm through another channel.

Real vs fake WeTransfer emails

Display names are easy to fake, so always read the full address; see display name spoofing. To see where a message really came from, paste its headers into the Email Header Analyzer.

Can a real WeTransfer transfer contain malware?

Yes. If the email passes every check above, it may still be a real transfer that a scammer sent. WeTransfer says it monitors and blocks abuse, and that for eligible plans downloads are scanned for known malware, but "no platform can catch every malicious upload." Because the notification really comes from WeTransfer, it will usually pass SPF, DKIM and DMARC; our file-sharing phishing guide explains why authentication can't help here.

WeTransfer lists these warning signs for a real transfer (WeTransfer Help):

• You weren't expecting the transfer, or you don't recognize the sender.
• The sender's name looks familiar but the email address doesn't match the person you know.
• The files are unusually small, "for example, only a few hundred KB".
• It claims to contain invoices, payments, contracts, tax documents or other financial information you weren't expecting.
• It tells you to visit another website, scan a QR code or call a phone number.
• The files have unexpected or suspicious extensions, such as .exe, .scr or .html.

A tiny "PDF" that's really an HTML file is a classic: opening it shows a fake sign-in page from your own computer. See HTML attachment phishing and dangerous email attachment types. A QR code in the files is quishing.

The phone-number variant

WeTransfer calls out "one increasingly common scam": files that look like invoices, subscription renewals, payment confirmations, cryptocurrency transactions or refunds, telling you to call a number if you don't recognize the charge. "The scam doesn't happen in the file itself; it happens when you call the number," where fraudsters try to get you to install remote access software, reveal banking information or send money. That's callback phishing; never call a number from an unexpected file.

What should I do if I clicked a fake WeTransfer link?

If you only opened the email, delete it. If you clicked and saw a sign-in page but typed nothing, close it. If you entered a password or opened a downloaded file, act now.

Do this now

1. Change the password you typed, from a trusted device. A fake page may ask for your email or Microsoft 365 password rather than a WeTransfer one, so secure whichever account you typed into.
2. Tell IT straight away if it's a work account, and say whether you approved a sign-in prompt or typed a code. Stolen session cookies can bypass MFA; see adversary-in-the-middle phishing.
3. If you opened a file, disconnect the device from the network and have it scanned before you use it for work.
4. Check your mailbox for new inbox rules, forwarding and sent mail you didn't write; see the signs your email account is compromised.
5. Warn the apparent sender by phone if the transfer used a real contact's name. Their account may be the one that's compromised.

For the full checklist, see what to do after clicking a phishing link.

If transfers were sent from your WeTransfer account

WeTransfer's account misuse article says to sign in, go to Account Settings > Profile and Security, choose to log out all active users, change your password and enable two-factor authentication, then delete unknown transfers from the Transfers tab. It explains that "To send a transfer through WeTransfer, someone needs access to an existing WeTransfer account or the verification code sent to your email inbox", so secure your email account too, and contact WeTransfer's Trust & Safety team if you suspect malicious activity.

If WeTransfer itself blocks your account because your password appeared in a breach elsewhere, its compromised password article says to avoid clicking links in unexpected emails and "instead sign in directly to your WeTransfer account" to change it.

How do I report a fake WeTransfer email?

For a real transfer with suspicious files, use Report this transfer. WeTransfer says "There's a 'Report this transfer' link available on every transfer", on the download page and at the bottom of the notification email, and that submitting the form starts a review (WeTransfer Help).

For a fake email that doesn't come from WeTransfer, use your mail app's phishing report button and delete it. In the US you can also report phishing to the FTC at ReportFraud.ftc.gov, as the FTC's phishing guidance recommends. Our guide to how to report a phishing email lists the options by provider.

What should a business admin do about WeTransfer phishing?

Blocking WeTransfer outright rarely works for businesses that exchange large files with clients, so focus on the senders and links.

1. Find every copy. Search by sender, subject and link domain with Microsoft 365 message trace or Google Workspace email log search, then remove the messages; see removing a phishing email from all mailboxes.
2. Block the fake sender and link domains, not wetransfer.com or we.tl.
3. Reset anyone who entered credentials, revoke their sessions and check their inbox rules and forwarding.
4. Set a file rule: unexpected transfers are confirmed by phone before opening, and invoices that arrive as transfers are checked against the supplier's known contact details. See vendor invoice fraud.
5. Block risky file types such as .exe, .scr and .html in email attachments where your platform allows it.

An MX-level inbound filter checks inbound mail for phishing links, spoofing and lookalike senders before it reaches users, and holds suspect messages in a quarantine each person can review. Our small business email security page explains where that layer fits alongside Microsoft 365 or Google Workspace.

Next steps

1. Share the one rule: hover first; a WeTransfer download goes to wetransfer.com or we.tl and never asks for your email password.
2. Confirm unexpected transfers with the sender by phone or a separate message before opening them.
3. Turn on two-factor authentication on your WeTransfer account if you have one.
4. Run the free Email Health Check on your domain, and if fake file-sharing emails keep getting through, see how iBlockSpam protects small business email.

Browse our other phishing and threat guides.