I'm am using a MacBook Pro 2012 using El Captain version 10.11.3

I received 5 minutes ago an email from WeTransfer ([email protected]) saying that "Your file has been sent to ***@libero.it. As soon as the recipient will have downloaded the file, you'll receive a confirmation email. Name of file: IMG_0508.mov", dimension: 30 MB", and there was a link to download. After 1 minute I received another email telling me that the file was indeed downloaded by the recipient.

The problem is that I never used WeTransfer, wasn't even aware of its existence 10 minutes ago! Apparently it's a legitimate service, which I never used. I don't know whose that email belong to (even though the email provider is well known in Italy) and I have no clue what is going on. Obviously I did not click on any link on the email, thinking it was just a scam mail that tries to make you click on the download button to install some malware.

But given that the company seems genuine, I'm worried that some hackers have somehow compromised my system and sent themselves a file with my stuff, and immediately downloading it (30 MB in one minute means the recipient is ready to receive the email). On the other hand I wonder why they would put my email address for me to receive such an email...

I disabled the wifi of the Mac and I am writing this from my phone. I also started a full system scan with BitDefender virus scanner (don't know how helpful it is, but still. I do it once in a blue moon though, never found anything)

So what has happened? What do I do now to protect myself?


I received another email just now. Apparently this person just sent me back this file, and WeTransfer informs me that I can now download this. So to recap: 1st email is about me sending file A to person B, 2nd email one minute later is to tell me that person B downloaded file A, and finally 10 minutes later to tell me that person B has sent me file A.

P.S. having trouble adding tags from the phone

  • Phishing. You should click any links they suggest you click, no matter what.. Also supply any user id's and passwords they ask for.. They know what they are doing, and what they want, so just do it right the first time and give them everything =]
    – Tyson
    Mar 20, 2016 at 1:23
  • 1
    @Tyson hard to find any sense in what you wrote. It's not even funny as I hope I made clear I am not completely unaware of this type of threats. Completely pointless comment
    – Ant
    Mar 20, 2016 at 1:29
  • Well, he may be right about the phishing part, not about anything else. I'll try to write an answer, but for now, keep your computer offline. Mar 20, 2016 at 1:53
  • My point exactly. They want you to worry about this. They want you to correct bad information. They want you to tell them how wrong they are.. And why. Get enraged and set them straight... Give them accuracy.. Give them facts.
    – Tyson
    Mar 20, 2016 at 2:07
  • 1
    Initial confusion was a typo, if no-one noticed... "Phishing. You shouldn't click any links they suggest you click.."
    – Tetsujin
    Mar 20, 2016 at 9:15

2 Answers 2


Or person C mistyped their email address and you're receiving their notifications.

Not at all unusual.

  • But if the company sends me a reminder my email, doesn't it mean that my email is registered on their server as a client?
    – Ant
    Mar 20, 2016 at 19:03

Firstly, we need to find out what exactly are the contents of the 30 MB file they sent with your email. Check the sender's actual email address. I advise you right click the download link, select Copy Link Address and paste it into your browser. This will tell us if it is a phishing scam or a virus deployment scheme.

BEFORE HITTING ENTER, read the link: what does it say? I've never used WeTransfer before, so;

Case 1: If the link seems legitimate and doesn't take the form of an IP address or a clearly non-WeTransfer affiliated site:

  1. Download the file from the link.
  2. If the file format is a form of compressed archive (.zip, .7z etc), take caution. Apple's Gatekeeper should prevent any unauthorised programs from running though. It would be best to use Pacifist to unpack the archive.
  3. Either in Pacifist or Finder, look through the contents of the sent file. If any of your personal data has been compromised, do the usual "change all passwords" routine.

Case 2: If the link does not seem legitimate and takes the form of an IP address or a clearly non-WeTransfer affiliated site:

  1. DON'T DOWNLOAD ANYTHING. I would advise against doing so, but if you feel confident you can use the above three steps and apply them to here.

Case 3: If the link redirects you to an appearance-legitimate-address-weird page (e.g random address: healthproducts.com asking for Google credentials and looks like a legit Google site) prompting you for your credentials:

  1. Don't enter anything. This is a classic phishing scam.

You can also try the above steps on the file they sent back.

EDIT: Tyson's second comment is correct indeed. It is in the nature of such scams to make you concerned about how they got your email address et cetera, so they want your email address (which they already know) and your password (which they don't). Definitely use the "change all passwords" routine here.

  • Thanks for the answer. In the meanwhile a BitDefender scan reveled I had Spigot installed... Apparently the antivirus took care of that but still I'm not too confident
    – Ant
    Mar 20, 2016 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .