Spotting a Suspicious Attachment Before You Open It

Why attachments deserve extra care

A link in a message leads somewhere you can look at first. An attachment is the thing itself. Opening a file can run code, display a convincing fake page, or prompt you to enter details. Harmful software can arrive this way, including the kind behind ransomware attacks, which locks files and demands payment.

Most attachments are harmless, and the aim is not to fear every file. It is to develop a quick sense of which ones deserve a second look.

Start with the context, not the file

The most useful question is not “Does this file look dangerous?” but “Was I expecting this?” Consider:

• Do I know the sender? If so, does the message sound like them?
• Is it related to something I am actually doing? An invoice for something you never ordered, a résumé when you are not hiring, or a “scanned document” from a printer you do not own is out of context.
• Is the message generic? Phrases like “see attached” with no details can indicate a bulk message.
• Is there pressure? Notices that demand you open a file to avoid a penalty, an account closure or a legal problem are a common pattern.

A real sender might forget to explain, so an unexplained attachment from a known person is worth a quick text or call to check. Hijacked accounts can send messages that appear to come from friends, so a familiar name is not enough.

File types that call for caution

Some types can run code directly, while others can carry hidden instructions. Be especially careful with:

• Programs and scripts, such as files ending in .exe, .scr, .bat, .cmd, .js, .vbs or .msi. There is rarely a good reason to receive these by email.
• Office documents asking you to enable macros or editing. A message that says a document is “protected” and that you must click a button to see the content is a classic trick. Macros are small programs inside a file. Unless you know exactly why you need them, do not enable them.
• Compressed archives, such as .zip, .rar or .7z, especially if password-protected with the password given in the message. The password can be used to stop security scanners from inspecting the contents.
• Disk images and shortcut files, such as .iso, .img or .lnk.
• PDF files that ask you to click a link or sign in to view them. PDFs themselves are common and usually fine, but they can contain links or embedded content.
• HTML attachments, which can display a fake sign-in page right on your device.

This is not a complete list. File types change, and new tricks appear.

Watch for disguises

Names can mislead. Examples to know about:

• Double extensions, like “invoice.pdf.exe”. Some systems hide known extensions by default, so the file appears to be a PDF. Turning on the display of file extensions in your system settings makes this easier to catch.
• Icons that do not match. A file can show a document icon while actually being something else.
• Unusually small or large files. A “document” of a few kilobytes, or a huge one, may not be what it claims.
• Names that mimic real documents, such as “Invoice_Final”, “Payment_Advice” or “Voicemail_Message”.

Practical steps before opening

1. Pause and check the sender’s real address, not only the display name.
2. Confirm through another channel. Message or call the person using details you already have, not those in the email.
3. Look at the file name and type. If it ends in a type that can run code, do not open it.
4. Preview in a safe way. Some email services open attachments in a restricted viewer, which is safer than downloading them to your computer. If a preview looks odd or asks you to sign in, stop.
5. Scan the file. Built-in security tools or reputable antivirus software can scan a downloaded file before you open it. They help, but they do not catch everything.
6. Keep software updated. Updates close weaknesses that harmful files rely on.
7. If in doubt, do not open it. Ask the sender to share the document another way, such as through a service you both already use.

At work, the stakes are higher

A single opened file can affect a whole network. Many workplaces have a process for reporting suspicious messages, and following it is better than deleting quietly, because others may have received the same message. Good workplace security includes making it easy and blame-free to ask.

What to do if you opened it

Do not panic, and do not keep clicking. Reasonable next steps are:

1. Disconnect the device from the internet or turn off Wi-Fi.
2. Do not enter any passwords or details if a page appeared.
3. Run a full scan with trusted security software.
4. From a different, clean device, change the passwords for your email and other important accounts, particularly if you entered any details. Using a password manager helps keep the new ones unique.
5. Watch for the signs described under account takeover signs, such as unexpected sign-in alerts or messages you did not send.
6. If you are at work, tell your IT team or manager immediately.
7. If you suspect financial details were exposed, contact your bank using an official number.

A backup that is separate from your computer is a major advantage if files are damaged or locked. Outcomes depend on what the file did, so getting help from a trusted technician is reasonable if you are unsure.

Keeping it simple

Your best habit is not to become an expert in file types. It is to treat unexpected files as unconfirmed until you have checked them. A short pause costs little, and it removes the element scammers depend on, which is a quick, automatic click.