How to spot fake Pandafile emails (phishing)

2 min read · Updated 2026-11-13

Short answer

Real Pandafile emails come from hello@pandafile.co, link only to pandafile.co, and never ask for passwords, card details or your sign-in code. If an email pushes you to log in urgently or pay, it is fake.

Scammers love copying file sharing emails, because people expect to click a download button. A few quick checks will keep you safe.

What real Pandafile emails look like

  • They come from hello@pandafile.co.
  • Every link goes to pandafile.co. Download links look like pandafile.co/d/ followed by a random ID.
  • A sign-in email contains a 6-digit code or a magic link, and only arrives when you asked for one.
  • A transfer email shows the sender, the files and when the transfer expires. You can download straight away, with no account needed.
Side by side comparison of a real Pandafile email from hello@pandafile.co with a pandafile.co link, and a fake one from another domain with a lookalike link asking for a password or card
Real versus fake: check the sender, the link and the request.

Red flags

  • It asks for a password. Pandafile accounts do not have passwords, so any request for one is a scam.
  • It asks for card or bank details by email. Plus and Pro payments only happen on a Stripe checkout opened from pandafile.co.
  • Someone asks you to read out or forward your 6-digit code. We will never ask for it.
  • Urgent threats such as verify now or your files will be deleted.
  • Lookalike addresses such as pandaf1le, pandafile-login or pandafile.co followed by another domain.

Check a link before you click

  1. On a computer, hover over the button and look at the address your email app shows. On a phone, press and hold the link to preview it.
  2. Find the domain: the part just before the first single slash. It must be exactly pandafile.co.
  3. If you are unsure, do not click. Open a new tab, type pandafile.co yourself and sign in there.
Hovering over a View files button reveals the link address, with the pandafile.co domain highlighted and examples of safe and unsafe addresses
Hover or long-press to see where a link really goes.

Got a fake email?

Do not click anything in it. Forward it to abuse@pandafile.co so we can warn others and get the fake site taken down, then delete it. If you already typed a code or card details into a fake page, contact your bank straight away and let us know.

Related guides

Is Pandafile encrypted? HTTPS explainedYes, every connection to Pandafile uses HTTPS, so uploads, downloads and sign-in codes are encrypted on the way between your browser and our servers. Pandafile is not end-to-end encrypted, so for very sensitive files, encrypt them yourself first.Are Pandafile download links secure?Yes. Every link is served over HTTPS, contains a long random ID that is practically impossible to guess, and stops working when the transfer expires. The weak spot is sharing: anyone who gets the link can use it, unless you add a Plus or Pro password.Who can see the files I send with Pandafile?Anyone who has the download link can open the transfer until it expires, so only share it with the people you mean to. Transfers are not listed publicly, and we do not look at your files except to act on a report or when the law requires it.
Ready to send?

Up to 10 GB a week free, no account needed.

Send files