is the pdf attachment? or some dodgy online fake pdf? for attachment i think it's hard for the sender to obtain password userd by user to decrypt?