Pause before you download or open
Unexpected attachments often arrive wrapped in ordinary-looking messages: an invoice, a delivery notice, meeting notes or a document someone says you need to review. You do not have to decide whether the file is dangerous at a glance. The useful first step is to pause and ask whether you expected this particular person to send this particular file. A familiar name alone is not enough; an account can be misused, and a display name can be made to look familiar.
Be especially cautious if the message pressures you to act quickly, keep the attachment secret, enable editing or provide a password. Those requests are not proof of a scam, but they are good reasons to slow down. If the attachment concerns a payment, account access or sensitive personal information, verify the request before interacting with the file.
Check the sender and the story
Look at the full sender address, not just the name shown in your inbox. Does the address fit the person or organization you know? Small spelling changes and unexpected addresses can be warning signs. Also check whether the message makes sense in context. A colleague might send a spreadsheet, but is it related to a project you share? Would this organization normally send you a document this way?
If you are unsure, contact the sender through a route you already trust, such as a saved phone number, an existing conversation or the organization’s usual website. Do not rely on a phone number or link supplied in the questionable email to verify that same email. A short message asking, “Did you send me an attachment called this?” can prevent a hurried mistake. If the sender says no, leave the file unopened and use your email service’s reporting option if one is available.
Examine the attachment without trusting its appearance
A file name can offer clues, but it cannot establish that a file is safe. Check whether the attachment type fits the explanation in the email. A supposed receipt that arrives as an application or a compressed archive, for example, deserves extra scrutiny. Some devices hide file extensions, so an icon or a familiar-looking name may not show you exactly what you are being asked to open. If you cannot tell what the file is, ask the sender to explain or send it another way.
Be wary of documents that ask you to enable macros, editing or other active content before you can read them. If a document unexpectedly sends you to a sign-in page, do not enter your password there. Open the service independently through your usual app or a saved address instead. Likewise, do not assume an attachment is safe because it appears in an existing email thread or has passed through an inbox filter. These are useful signals, not guarantees.
Use safer ways to get the information
If the message says a bill, shared document or account notice is waiting, consider going directly to the service you normally use rather than opening the attachment. For a work or community group file, ask whether the sender can place it in the shared workspace you already use. This gives you a chance to confirm both the request and where the document came from.
Keep your device, email app and document software updated, and use the security features available on your device. They may catch some harmful files, but they do not replace checking the message’s context. On a shared or managed device, follow your organization’s procedures for suspicious mail. You should not need to install an unfamiliar program just to view an unexpected attachment.
If you already opened it
Opening a file does not automatically mean your device or account has been compromised. Still, if the file behaved strangely, asked you to enable active content or led you to a login page, stop interacting with it. Do not enter more information or forward the attachment to someone else for an informal opinion. Note what you opened and what actions you took so you can describe the situation clearly.
If you entered a password, change it through the service’s usual app or website, and review your account’s security settings. If you use the device for work, tell your support team promptly so they can advise you on the next steps. Otherwise, run the security checks available on your device and seek help from a trusted support provider if you notice unusual behavior. The goal is to respond calmly and quickly, not to guess what the file did.
