How to Treat Password-Protected Attachments From Unknown Senders

Why a password is not a trust signal

Encryption can protect a legitimate document in transit, but it does not identify the person who created it or establish that the file is safe. An attacker can also put a harmful file inside an archive, send a password in a second email, or compromise a real sender’s account and imitate their normal process. The extra step may make the message feel more credible without adding meaningful proof.

Password protection can also limit what security systems are able to inspect before a file is opened. A scan or a clean-looking message is not a guarantee that an attachment is harmless. Do not treat a password, a professional-looking document name, or a reassuring explanation as a substitute for checking the context.

Verify through a route you already trust

First check whether you were expecting the file and whether the reason makes sense. Then contact the supposed sender using a phone number, messaging account, or email address you already had before this message arrived. For a work contact, use your organization’s established directory or communication channel. Do not rely on a phone number, callback link, or reply address supplied only in the questionable message.

Ask plainly whether they sent the attachment, what it contains, and why it is password-protected. Confirm the password delivery method as well. A second message from the same unknown address is not independent verification; both messages could come from the same attacker or compromised account.

Check the sender and the request together

Look closely at the full sender address, not just the display name. Watch for misspellings, unexpected domains, or a familiar name paired with an unfamiliar address. These details can raise concern, but an address that looks correct does not prove the account has not been compromised.

Consider whether the request fits the relationship and timing. Were you expecting an invoice, contract, application, or other document? Does the sender explain why it is being sent now? Is there pressure to open it quickly, keep it secret, or enter credentials after opening? Any mismatch is a reason to pause and verify, not a reason to hurry.

A practical check before opening

Use this short checklist before handling an unexpected protected file:

• Was I expecting this specific file from this person or organization?
• Have I confirmed the sender and purpose through contact details I already trust?
• Did that confirmation also establish how the password was sent?
• Can I explain why the file needs to be protected, rather than relying on the message’s reassurance?
• If any answer is no or uncertain, have I left the attachment unopened?

You receive an unexpected protected invoice from alex@example.com, followed by a password from a different address. Before opening either attachment, contact Alex using a number or work channel already on file. Ask whether Alex sent the invoice, confirm its purpose, and check the password arrangement. If Alex cannot confirm it, do not try the password; report the message through your organization’s established process.

If the context cannot be confirmed

Do not open the file, enter its password, or follow instructions inside the message. Avoid replying to the sender to ask whether it is genuine; a reply may reach the attacker or simply invite a convincing answer. If the message came to a workplace account, use your organization’s security or IT reporting process. For a personal account, use the provider’s available reporting controls if present, or ask a trusted support contact how to handle it.

If you need the document, ask the supposed sender to confirm it through a trusted channel and, if appropriate, provide it through a method your organization accepts. Do not forward the suspicious attachment to others as a warning unless your reporting process specifically requests it.

Confirm the situation is resolved

You have completed the check when the sender independently confirms both the file and its purpose, and you have followed the appropriate handling process. If that confirmation does not arrive, or the sender denies sending it, keep the attachment unopened and report or decline it. Do not interpret silence as approval.

If you already opened the file or entered its password, stop interacting with it and report what happened promptly through your workplace security process or trusted account support. Say whether you opened the attachment, entered the password, or followed any instructions; those details help determine the next steps. This article cannot establish that a particular file is safe. When the sender or reason remains uncertain, the safer choice is not to open it.