We sent email attachment to a vendor for the Vendor Payment. When the vendor receives the email and opens the attachment, a notepad us opened instead with this message, This attachment has been removed from the email. Please quote key XXXXXXXXX (actual value is masked) if contacting support.

that's the vendor's email server removing the attachment. They can probably whitelist the sending domain, but is there something in the file that it could see as potentially dangerous? Are there links in the PDF?