Short answer: a PDF can be used to send a harmful link, attachment, or exploit. Treat an unexpected PDF the same way you would treat any unexpected file: verify the sender and inspect it carefully before interacting with it.
Where PDF risk can come from
A file extension alone does not make a document safe or unsafe. Problems can arise when a PDF encourages you to click an unfamiliar web link, open an embedded attachment, enable content, or download another file.
Unexpected links
Links can lead away from the document to a website that imitates a bank, employer, delivery service, or account portal. Hover over links on desktop, or long-press carefully on mobile, before opening them.
Embedded files and unusual prompts
A PDF may include attachments or instructions to download a viewer, enter a password on an external site, or urgently contact somebody. Pause and independently verify the request.
Do not rely on urgency.
“Open immediately,” “payment overdue,” or “account suspended” messages are designed to rush a decision. Check through a known website or trusted contact channel instead.
Quick PDF safety checklist
Were you expecting the document? Does the email address match the real organization?
Look for spelling changes, unfamiliar domains, and link text that does not match the destination.
Ask the sender using a separate trusted channel first.
Security updates help protect against known software weaknesses.
If you are unsure, do not forward the file until it has been checked.
Warning signs to take seriously
- The file arrives unexpectedly or the sender’s wording feels unusual.
- The message asks for credentials, payment, or urgent action.
- A PDF asks you to install software, disable protection, or download another file.
- A link uses a strange address or a misspelled company name.
- The document contains a suspicious attachment or does not match the message description.
Before you share a PDF
Security is not only about opening files. Before sharing your own PDF, remove unnecessary personal information and check it for links or attachments you did not intend to include. This is especially important for invoices, resumes, contracts, and documents created from templates.