What to Check Before Opening an Unexpected Attachment

Start with the message you expected

Ask yourself whether you were expecting a file from this person at this time. Did you recently request a document, receive a delivery notice or discuss a project that would explain it? An attachment that appears without a related conversation deserves extra care, even if the sender’s name is familiar.

Read the whole message rather than relying on its subject line or display name. A vague prompt such as “open this” or an urgent request to review a file may not explain what it contains. Check whether the wording, timing and purpose fit what you know. A mismatch is a reason to pause, not proof by itself that the message is malicious.

Check who actually sent it

Look at the sender’s full email address, not only the name shown beside it. Compare it with an address you have seen before, paying attention to small spelling changes or an unfamiliar domain. Be cautious if the message asks you to reply to a different address or directs you to contact someone using details included only in that message.

A familiar-looking address still does not settle the question: an account can be misused, and names can be made to look convincing. If the file is unexpected or the request is unusual, confirm it through a separate route. Use a phone number or contact method you already have, rather than replying to the message or using a new number supplied with the attachment.

Ask for a clear purpose

Before opening the file, establish what it is, why it was sent and what the sender expects you to do with it. A useful confirmation identifies the file or explains its purpose in terms that match your conversation. “I sent you the revised schedule for the meeting we discussed” is more informative than “check the attachment.”

Keep the confirmation separate from the message you are checking. If you contact the sender through a trusted, previously used channel and they cannot explain the file, do not open it. If they say they did not send it, do not forward it around for others to inspect; report it through the email or organisation’s established security process, if one is available.

Treat unexplained file types as a stop sign

Consider whether the file type makes sense for the task. A document you asked for may be expected in a familiar document format; a request to open an unfamiliar executable, script or compressed archive needs a much stronger explanation. Do not rely on a filename or icon to tell you what a file really contains, and do not rename a file to make it seem more ordinary.

If you cannot explain why that type is needed, leave it unopened and ask the sender to clarify or provide the information another way. Do not enable active content, bypass a warning or follow instructions to change security settings just to view a file. If the sender cannot provide a clear, credible reason, stop there.

Use scanning as one check, not permission

A security scan may detect some known threats, so it can be a useful part of handling an attachment. It cannot establish that every file is harmless. A clean scan does not confirm who sent the file, whether it was intended for you or whether its contents match the sender’s explanation.

Keep the checks separate: confirm the sender and purpose, consider the file type and use available security scanning. A positive detection means do not open the file; follow your provider’s or organisation’s reporting process. A scan that finds nothing is not a reason to ignore a confusing context, an unexpected request or a warning from your device or mail service.

A quick decision before you click

Use this short checklist before opening an unexpected attachment. If any answer is unclear, pause and verify rather than trying the file. For work accounts, follow your organisation’s security procedures as well; the right reporting route may depend on your role and its policies.

You can confirm your check worked by getting a clear explanation directly from the sender through a trusted, separate channel and matching that explanation to the file and its purpose. If you cannot do that, the safe decision is to leave it unopened.

• Was I expecting this file, and does it fit the conversation?
• Have I checked the full sender address and confirmed the message independently?
• Do I understand why this file type is needed?
• Have I avoided opening it if the context is unexplained, even if a scan reports no issue?

Unexpected message: “Please review this file today.”
Pause: You did not request a file and the message gives no purpose.
Verify: Contact the sender using a number or address you already trust.
Decide: If the sender confirms what it is and why they sent it, assess the file type and use available scanning. If they cannot confirm it, leave it unopened.