Enrichment · Passion Projects

Send the file.
Not the risk.

Tax forms, medical records and ID scans are exactly what scammers ask for and what ordinary email leaks. Most of the protection is simple: confirm who is asking, use their secure portal or an encrypted file, send the password another way, and clean up afterward. Log each transfer and the checklist scores the choices you made.

Check a transferWhat you get

Your transfers

The worked example is made up: tax forms sent through a preparer’s portal, and an ID scan someone asked for by email. Saved on this device only.

Loading the transfer form. If nothing appears, turn on JavaScript.

What you get

Enrichment · Passion ProjectsFree

What you finish with
A record per transfer: what is in the file, who receives it, how the request came, the method, how any password travels, how the recipient was confirmed, how long access lasts and eight checks. Scores exposure from those choices as low, medium or high and counts checks done; flags ordinary email for sensitive data, unconfirmed requests, passwords sent with the file and long-lived links.
Who it is for
Students, families and adults sending personal documents to schools, landlords, preparers, doctors or employers.
Format
Browser checklist with a saved record per transfer. Prints one transfer, every transfer in a table or a blank sheet; downloads a spreadsheet (.csv); exports and imports a file.
Access
Free. No account, no sign-in and nothing to install. Everything you type stays in this browser; nothing is sent to Caveat.
Where it lives
The Passion Projects space in Caveat Enrichment.
Support
Questions about access, an order or a correction: team@caveatacademic.com.

How to use it

  1. Describe the file and who is asking for it.
  2. Pick the method and how the password travels.
  3. Confirm the recipient by a number you already had.
  4. Work through the checks.
  5. Clean up the shared copy once it has arrived.

Check a transfer

Five ways to send

Ways to send a sensitive fileMethodIn transitWatch forRecipient’s portalEncryptedCheck the web addressEncrypted emailEncrypted end to endBoth sides must set it upExpiring share linkEncryptedNamed person only, short lifePassword-protected fileEncrypted, if AES-256Password sent another wayOrdinary email or textOften readableCopies stay in inboxesWays to send a sensitive fileRecipient’s portalIn transit: EncryptedWatch for: Check the web addressEncrypted emailIn transit: Encrypted end to endWatch for: Both sides must set it upExpiring share linkIn transit: EncryptedWatch for: Named person only, short lifePassword-protected fileIn transit: Encrypted, if AES-256Watch for: Password sent another wayOrdinary email or textIn transit: Often readableWatch for: Copies stay in inboxes
The biggest risk is often not the method but the recipient: a convincing request from someone who is not who they say.

How the score works

Points add for the method (ordinary email or text 3, fax 2, a link or protected file 1, a portal 0), a password sent with the file (2), a recipient not confirmed or confirmed only by replying to an unexpected request (2) and a link that never expires (1). Files with nothing sensitive score 0.

Changed instructions

A message saying “use this new address” or “upload here instead” is the most common sign of a hijacked account. Call the person or office at a number you already had before sending anything.

Sources

  1. Federal Trade Commission. How to recognize and avoid phishing scams (consumer.ftc.gov).
  2. Cybersecurity and Infrastructure Security Agency. Secure Our World: recognize and report phishing; use strong passwords (cisa.gov).
  3. Internal Revenue Service. Publication 4557, Safeguarding Taxpayer Data (irs.gov).
  4. National Institute of Standards and Technology. SP 800-63B: Digital Identity Guidelines, authentication and lifecycle management (nist.gov).

The worked examples are made up. The exposure score is a simple sum of the choices described above, for comparison only; it is not a security audit. Nothing you type is sent to Caveat. Support: team@caveatacademic.com.