The rule that keeps this simple
A verification code maps to exactly one sealed fingerprint in Opcilo. The filename on an email attachment is cosmetic. Trust the Verify page — and optionally “Verify your own copy” — not the attachment name.
Case 1 — Real Opcilo code + infected attachment (bait)
Someone steals or copies a legitimate seal link and emails malware named like a familiar invoice or contract. The verify page may look “correct” because the code is real — for the clean sealed file in Opcilo, not for the attachment.
- 1
Email arrives
Lookalike filename + malware attachment + real-looking Opcilo link/code.
- 2
Risk: open the attachment
Risk pointYour device can be infected. Opcilo never saw that email file.
- 3
Safer: open the verify link
Safe pathPage shows the canonical sealed record from Opcilo storage.
- 4
Use “Verify your own copy”
Safe pathUpload the attachment → SHA-256 mismatch. Filename is ignored.
Risk is opening the email file. Safety is opening Verify and comparing your copy (or downloading only from the verify page).
How Opcilo resolves Case 1:
- Each seal code is unique and bound to one sealed fingerprint.
- Preview and download on Verify come from Opcilo storage, not from email.
- Optional file check compares the bytes you upload to the sealed hash.
- A matching filename never makes an attachment “verified.”
Case 2 — Attacker seals the malware themselves
The attacker uploads the infected file to their own workspace and gets their own unique code. They cannot reuse someone else’s code for different bytes. Malware scanning on the seal path flags infected uploads so sealing fails. If a novel sample ever slips past scanners, the seal could still complete for those bytes — then file-check would match, and you must judge the issuer and use Report.
- 1
Attacker uploads malware
They request a seal under their own account.
- 2
Malware scan on the seal path
Safe pathInfected verdict blocks sealing. Novel or unknown samples remain a residual industry risk — then issuer signals and Report matter.
- 3
If sealed, verify shows their record
Safe pathIssuer signals (new / email verified / business) and Report → Malware matter most.
- 4
Recipient reports abuse
Safe pathUse report on the verify page when the issuer or document feels wrong.
A “valid” seal here only means those exact bytes were sealed by that issuer — not that the content is trustworthy.
How Opcilo resolves Case 2:
- Codes cannot be cloned onto a different file hash.
- Malware scanning on the seal path fails the seal when an upload is flagged as infected.
- Verify shows Document integrity plus issuer cues (email-verified or Issuer Verified after business verification (Know Your Business, or KYB)); Identity is Not checked — accountability cues, not a truth guarantee.
- Recipients can report seals (including malware) for review.
What to do in practice
A short habit that closes most of this gap:
Open the official verify link
Use Verify (or the link from someone you trust). Prefer downloading from that page.
If you still have an email attachment, check it
Use “Verify your own copy.” Mismatch means the attachment is not the sealed file.
Read the issuer signals
New accounts deserve more caution. Report anything that feels like impersonation or malware.
For the wider fraud landscape, see Why document fraud is a bigger problem. For sealing basics, see What is document sealing?.
Frequently asked questions
Does a valid Opcilo code mean my email attachment is safe?
No. The code verifies Opcilo’s sealed copy. Your attachment is only proven if check-my-copy matches — or if you download only from the verify page.
Can two different files share the same seal code?
No. Each seal code is unique and bound to one sealed fingerprint.
What if the attacker sealed the malware themselves?
The seal can look valid for their bytes. Check issuer signals, avoid unexpected attachments, and use Report on the verify page.