Why blocking the sender doesn't stop Google Drive share phishing

The first instinct after a malicious Drive share is to block the sender. In a Drive-share attack the sender is Google, the account that shared the file is someone else, and the person named in the document is a third party. Which of the three you can block, what each block actually does, and what works instead.

The staff member forwards it with one line: can you block this sender? The sender is drive-shares-dm-noreply@google.com. Blocking it would stop every Drive share notification in the district, and the malicious document would still be sitting in forty people's Shared with me.

That instinct is reasonable, and it is aimed at the wrong identity. This guide is about the three identities in a Drive-share attack, what a block on each of them actually does, and what to do instead.

The short answer

Three identities, not one. The mail sender is Google's notification service. The Drive sharer is the Google account that made the share, which is the attacker or an account the attacker has taken over. The impersonated person is whoever's name is on the document. They are usually three different parties.

Blocking the mail sender blocks Google. Every legitimate share notification stops arriving, the shared file does not go anywhere, and the block does nothing to the next campaign either, because it will arrive the same way.

Blocking the Drive sharer works, narrowly. It stops that one account. Campaigns that run on compromised or disposable accounts move to the next one.

The controls that work act on content and on receiving, not on the sender: content-based mail rules, restrictions on who can receive external shares, removal after review, and staff who look at the sharer rather than the sender.

The three identities, with a fictional example

A district's staff receive this notification:

Dana Whitaker (via Google Drive) shared a document with you
Salary Schedule Update
payroll.updates.k12@example.com shared this file with you.

Take it apart:

IdentityIn this exampleControlled by
The mail senderdrive-shares-dm-noreply@google.com, the From address (Google uses more than one such address)Google
The Drive sharerpayroll.updates.k12@example.com, the Google account that created and shared the fileThe attacker
The impersonated personDana Whitaker, the district's superintendent, whose name was typed into the sharer's profile and the documentNobody involved

Google documents why this structure works on people. Of Drive-share phishing, its administrator help says the links "can also appear in Drive's automatic email notifications. Because the email notifications come from Google, users might be tricked into thinking message contents are legitimate." The Drive API even has a field for the second identity, sharingUser: "The user who shared the file with the requesting user, if applicable." That field is the one that matters, and it is the one nobody reads.

In a second common variant the sharer is athletics@lakeshore-csd.example, a real account at a neighboring district that has been compromised. Same three identities. The only difference is that the second one now belongs to a victim.

What blocking each identity does

Blocking the mail sender

Gmail's blocked-senders setting is described by Google as a way to "help prevent spam and malicious email by blocking email addresses or entire domains. This way, you're automatically rejecting messages from them." Applied to Google's notification address, it rejects every Drive share notification your users would otherwise receive: a teacher sharing a rubric with a colleague, a parent returning a form, the business office circulating a budget. Applied to google.com as a domain it takes a great deal more with it.

And it does not remove the file. The share was made in Drive; the email only announced it. Everyone the document was shared with still has it under Shared with me, and can still open it by going there. The block removes the reminder and leaves the lure.

Blocking the Drive sharer

Two places offer this, and they do different things.

In Drive, a recipient can right-click the file under Shared with me, choose Block or report, and choose to block the user. That stops that account from sharing with that one user again. It is per recipient, not domain-wide, and Google notes that files owned by your own organization cannot be reported this way.

In Gmail, adding the sharer's address to blocked senders does not stop the notification, because the sharer's address is not the sending address. Google describes the setting as blocking messages from an address; the notification is from Google. The sharer's address appears in the message body, which is not what a sender block matches.

Either block has real but small value. A campaign that uses disposable or compromised accounts simply rotates to another one, and a campaign run from compromised accounts at other organizations may already be using a different sender for each wave. You will be one account behind for as long as you keep blocking.

"Blocking" the impersonated person

There is nothing to block. The superintendent did not send anything, share anything, or have anything taken. Resetting her password, which is a common reflex, changes nothing about the incident and costs her an afternoon. The check that matters is whether the sharing account is in your domain. If it is, that account is compromised and the response is account containment. If it is not, she is a name in a lure.

One thing does help her: telling staff, in advance, that leadership never distributes pay, HR or evaluation documents by unsolicited Drive share. Then her name on such a document is itself the warning sign.

Why Gmail's spoofing protections don't catch it either

Gmail's setting Protect against spoofing of employee names is aimed at a nearby problem. Google describes it as protecting "against messages where the sender's name is a name in your Google Workspace directory, but the email isn't from your company domain or domain aliases." That is an outside sender putting your superintendent's name on a message. In a Drive notification the sender is Google's service, and Google does not document whether this check applies to its own notification mail. It should not be relied on to. The related settings for lookalike domains and unauthenticated mail are aimed at spoofing too, and there is no spoofing here: Google sent the message, and every authentication check says so, correctly.

What works instead

Match on the content, not the sender. A Gmail content compliance rule can examine the headers and body of inbound mail and quarantine, reject, or modify what matches. Matching on the campaign's specifics, the document title, the sharing account or its domain, the destination domain in the body, catches this wave without touching legitimate notifications. Google lists content compliance as available on Education Fundamentals, Standard and Plus. The methodology is its own guide: using Gmail content compliance to quarantine Drive phishing.

Control who can receive external shares. Google's own recommendation for Drive spam and phishing is an allowlist of trusted domains with the option to receive files from outside it turned off, or, on Education Standard and Plus, trust rules with a Receiving files trigger whose scope is the intended recipient. That is a control on the second identity as a class rather than one account at a time, and it has real operational cost for staff who collaborate outside the district; the trade-offs are covered in how to reduce Google Drive share phishing.

Remove the delivered notifications after review, so the easy path to the document is gone from the inboxes it reached: how to remediate Google Drive share phishing.

Report the file. Each recipient's report in Drive notifies Google, and Google's own evaluation of externally shared files can block access for everyone. You cannot force that, but reports are the input to it.

Teach the one check that generalizes. Look at the account that shared the file. Not the name, not the sender, the account. Every other check in this guide is a workaround for the fact that most people never do.

What not to do

Do not block Google's Drive notification addresses (drive-shares-dm-noreply@google.com, drive-shares-noreply@google.com) or google.com. You lose every legitimate Drive notification and keep the malicious file.

Do not add the sharer's address to Gmail's blocked senders and consider it handled. It does not match the notification, and the next wave uses a different account.

Do not reset the impersonated person's password as a first move. Find the sharing account, then decide.

Do not stop at blocking when it is available. A Drive block on the sharer is fine to do. It is not the response; it is one recipient's housekeeping.

Sources

ORINEX Workspace Compliance takes the same position in its Message Removal tool: the "block future mail" filter can match on a phrase in the message rather than the sender, because for Drive-share phishing the sender is Google. What ORINEX Workspace does.