What happens when you report a Share link to us

Rachel keeps the books for a small building firm. On a Tuesday morning an email arrives that looks like it's from one of the firm's regular suppliers: a new invoice, and a note that their bank details have changed. The invoice is behind a Share link.

She opens it. The supplier's logo is right, the amounts look normal, but the sort code is new and the email came from an address one letter off the real one. She rings the supplier on the number she already has. They sent nothing.

This is fraud, and the link is still out there for the next person on the list. So she reports it.

What she sends

Send us the URL link up to the #.

Leave out everything after it: that's the encryption key.

Rachel writes to report@refueler.io. She includes:

• The link, up to the #.
• A sentence or two on what it is. "A fake supplier invoice asking us to pay a new account."
• When she saw it.

She doesn't attach the invoice. She could forward the email that carried the link, and that helps, because the email is where most of the evidence sits. We can't see inside the file, so what she tells us is what we work from.

If she had sent the whole link by mistake, with the key part, we would never open it. We'd remove the key part from our copy of her email and work only from the transfer ID.

What she hears back

Within two working days, Rachel gets a reply from Refueler Share. It thanks her, names the link she reported, and asks for anything else she can tell us. Her report has a reference of its own, at the top of every email we send her about it.

Her email address stays in that mailbox thread and nowhere else. Our record of the report holds the first eight characters of the transfer ID, the kind of report, what we decided and when. It never holds her name or address, or anything about the file.

What we check

First, whether the link is still live. A Share link can close on its own: the sender's time limit runs out, or the file is deleted after its first download. If it has already closed, there's nothing left to take down, and we tell Rachel that.

Rachel's link is still live, with five days to run, so we read what she's told us. A fake invoice asking for payment to a new account is fraud under UK law, and fraud is one of the kinds of illegal content we act on. We take the link down.

Taking a link down deletes the encrypted file from our storage for good. We never held the key, so there was never a readable copy to keep, and there's no way to bring it back.

What the next person sees

Anyone who opens that link now, including whoever it was aimed at next, sees this:

This file is no longer available.

We took the link down after a report. If you have a question, or think this was a mistake, write to us and give the reference. We read every message.

Below it are report@refueler.io and a short reference: the first eight characters of the transfer ID. The page doesn't say what the report was about, or who made it.

What we can't tell her

Rachel would like to know who sent it. We can't tell her, because we don't know: you don't need an account to send a file on Share. What we can say is that the link is closed.

If money has already gone, the people to tell are your bank, straight away, and the police's fraud reporting service. They can act on payments; we can only close links.

The last email

Once it's done, Rachel hears from us again: we've looked at her report, and we've removed the link. If she disagrees with anything, she can reply to that email.

And the person who shared it

They can write to report@refueler.io with the reference from the closed page and ask us to look again. If we got it wrong, we say so and apologise, but the file can't be restored. That's why we only take a link down when what we're told makes it clear.

Reports that can't wait, about child abuse or terrorism, are handled the same day, and we take the link down before we reply. That's the next piece in this series.

How to report, in brief, is on the support page.