"A secure document has been shared with you from the Secretary of the State." Download the attachment. Enter your personal access code to unlock it.
Here's a hypothetical, and everyone in it is made up. Dana (made up) runs Copperhollow Landscaping (a made-up landscaping company) in Connecticut. The email landed at 4:52 p.m. while she was still in the truck.
The subject line started with "RE:", like a reply to something she'd sent. She had sent something. Two weeks earlier she'd filed a change of address for her LLC, and she was waiting on the state.
So the email didn't feel random. It felt like the answer.
There was an attachment, a six-digit access code, a reference ID, and a line at the bottom: "Do not share your personal access code." It looked more careful than most things the state sends.
She opened the file on her phone. A login box popped up: "Verify your email to unlock this document." Her business email, the one every funder, customer and her bank write to.
Her thumb was on the password field.
Then she noticed the sender. It didn't end in @ct.gov. She closed the page, typed Business.CT.gov herself and logged in. No new document. No message.
The code was never a lock. It was the bait. It's there to make you feel like you're the careful one.
This one is active right now. On Oct. 21, 2026, Connecticut Secretary of the State Stephanie Thomas warned all Connecticut businesses about a malicious email with the subject "RE: Connecticut Office of the Secretary of the State, Business Services Division." It says a secure document was shared, and asks people to download an attached file and enter an access code to unlock it through a "DocuSafe Secure Portal" (CT Secretary of the State).
It isn't one state. Michigan's licensing agency (LARA) has an example of the same lure posted by its Bureau of Professional Licensing: a "secure document" from that bureau, a personal access code, a reference ID, and a sender address that wasn't a michigan.gov address. Even the footer was off. It spelled the portal "PortaI", with a capital I where the l should be (Michigan LARA).
Red flags
An email from a state agency where the sender's real address doesn't end in that state's .gov domain. Hover over or tap the "from" address to see it (CT Secretary of the State).
A lookalike address that's almost right, such as cct.gov or ct-gov.org. Connecticut says to stay suspicious even when the address looks official (CT Secretary of the State).
A "secure document" you have to unlock with an access code from the same email (CT Secretary of the State, Michigan LARA).
A login page that asks for your email password before it shows you anything (FTC).
A link or attachment you're told to open to deal with a filing. Connecticut says you never need to click a link to make a business filing (CT Secretary of the State).
What to do
Don't open the attachment, don't click the link, and don't reply (CT Secretary of the State).
Go to the state's business portal yourself by typing the address. In Connecticut that's Business.CT.gov. Anything real will be waiting in your account there (CT Secretary of the State).
Turn on multi-factor authentication for your business email and state filing account (FTC, CT Secretary of the State).
Already typed your password? Change it now, starting with your email, then any account that uses the same password. If you opened the file, update your security software and run a scan (FTC). If you gave out your Social Security, bank or card numbers, go to IdentityTheft.gov for the steps that match what you lost (FTC).
Report it. Forward the email to reportphishing@apwg.org, report it at ReportFraud.FTC.gov, and let the agency it pretended to be know (FTC, CT Secretary of the State).
Dana (made up) deletes the email, texts a screenshot to two other owners, and goes back to her invoice.
Sources:
Connecticut Secretary of the State, Secretary Thomas Warns Businesses of Phishing Email Impersonating State Business Services Division (Oct. 21, 2026): https://portal.ct.gov/sots/press-releases/2026-press-releases/secretary-thomas-warns-businesses-of-phishing-email-impersonating-state-business-services-division
Michigan LARA, Example of a Fraudulent Secure Document Email: https://www.michigan.gov/lara/bureau-list/bpl/identity-protection/content/example-of-a-fraudulent-secure-document-email
FTC, How To Recognize and Avoid Phishing Scams: https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams
FTC, IdentityTheft.gov: https://www.identitytheft.gov