When the expectation is missing
Fictional example: Sofia receives a file called “New pictures” from an acquaintance. They had not arranged to exchange photographs. Sofia calls the number already saved in her contacts. Her acquaintance sent nothing. The file remains unverified; Sofia does not need to open it to investigate its contents.
An expected file whose purpose and sending have been confirmed independently is a different situation. Even then, updated applications and existing protection remain useful. Confirmation is an important check, not an absolute guarantee of safety.
Ask three questions first
First: does the file fit an actual arrangement? Second: can the sender explain what it contains? Third: can you reach that person outside the questionable message? A reply in the same email conversation is weaker evidence if that account itself may be compromised.
For a business, use existing customer contact details or a portal you open yourself. Ask, for example, for the order reference and the intended document type. You do not need to send the attachment back or disclose your own credentials to ask those questions.
A filename is a clue, not permission
A label such as “Invoice” or a familiar file extension does not prove the contents. A picture or PDF is not categorically safe merely because it has that name. An archive can contain additional files whose purpose is not initially apparent.
Avoid simple rules such as “I can always open this format”. If a document unexpectedly asks you to enable macros, active content or another security exception, stop. Microsoft describes macros as a possible vehicle for harmful functions. Do not disable protections just to make an unknown attachment readable.
Agree another way to receive the information
If you really need the information, obtain independent confirmation and request an understandable official route or a plain-text summary. For an invoice, the genuine customer portal may be appropriate; for a meeting, the date and address in plain text may be enough.
Do not upload private documents indiscriminately to public checking tools. A suspicious file may still contain confidential information. On a work device, the internal IT team is the appropriate contact. Do not bypass organisational safeguards for a supposedly urgent document.
If you already opened the file
Record what happened next: viewing it, entering credentials, enabling extra content and installing something are different actions. Those distinctions help assessment. Close the file, perform none of its further requested steps and seek qualified help if concerned.
Report an incident on a work device promptly through the internal process. For a personal device, use official manufacturer support or a trusted technical service. A clean virus scan alone cannot exclude every possible incident. Give an accurate account of your actions without distributing the unfamiliar attachment to more people.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Is a familiar sender name enough?
No. Names can be imitated and genuine accounts can be compromised. Check an unexpected file separately.
Is a preview always safe?
There is no universal guarantee. Preview features and applications differ. Do not open an unclear attachment merely to test it.
Should I send the file to friends to check?
Not unsolicited. You would spread potentially harmful or confidential content. Use an appropriate support route instead.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- Polizeiliche Kriminalprävention: E-Mails und AnhängeSource review date:
- Microsoft: Schutz vor MakrovirenSource review date:
- BACS: Verdächtige Rechnungen und mehrstufige DateianhängeSource review date:
