Opening an attachment you now distrust can be unsettling, but guessing what it did is less useful than taking careful next steps. Stop interacting with the file, avoid trying to investigate it yourself, and record what you remember while the details are fresh. If the device belongs to your workplace or school, follow its incident-reporting instructions and contact the designated support team. On a personal device, ask a trusted administrator or security professional for help. These steps do not diagnose whether anything harmful happened; they help others assess the situation without adding avoidable risk.
The useful bits
- Close the attachment and do not reopen, forward, or delete it as an improvised fix.
- Record the message, file, timing, and actions you took without changing the evidence.
- Report the incident through your organization or consult a trusted security professional.
Stop, then leave the file alone
Close the document or attachment if it is still open. Do not click more buttons inside it, enable content or macros, follow links it displays, or enter a password or verification code in response to a prompt. Do not reply to the sender to ask whether the file was genuine.
Avoid opening it again to check what it does. Also avoid forwarding the attachment to coworkers or friends; that can expose them to the same uncertainty. Deleting the file or message may seem like a quick fix, but it can remove information a support team needs. Wait for guidance before taking cleanup steps.
If the device is managed by an employer or school, do not install tools, change security settings, or disconnect it from a network unless your organization’s instructions say to do so. Those actions can interfere with normal operations or with an investigation. Follow the incident procedure you have been given.
Write down a useful account
Make a brief, factual note while you can still remember the sequence. Record when the message arrived and when you opened the attachment, who it appeared to come from, the subject line, the attachment’s displayed name and type, and what happened afterward. Include anything you clicked, typed, or approved, even if you are unsure whether it mattered.
Keep the original message if it is safe and practical to do so, and follow your organization’s instructions for reporting it. Do not take screenshots or copy files if policy prohibits that or if doing so would require reopening the attachment. A clear account is more useful than a guess about whether the device is infected.
Message appeared to be from: [sender name or address] Subject: [subject line] Attachment shown as: [filename and type] Opened at: [approximate date and time] After opening, I: [describe clicks, prompts, or information entered] Device: [work, school, or personal; device type if known]
Use workplace or school reporting channels
If you used a work or school device, contact the help desk, IT administrator, or security contact specified by your organization. Use a separate, trusted route if you are unsure whether the message itself is safe—for example, a known internal phone number or support channel. Report promptly, even if nothing unusual appeared.
Share the factual notes and answer follow-up questions honestly. Mention whether you entered credentials, approved a prompt, or saw a request to enable content. Do not downplay an action because it seems embarrassing; accurate details help the responsible team decide what to do.
Your organization may ask you to keep using the device, stop using it, or take another specific action. Follow its directions rather than applying generic advice. If you cannot find the reporting procedure, ask a manager or administrator to connect you with the appropriate support contact.
For a personal device, get trusted help
If the device is yours, contact a security professional or a trusted administrator who can assess the situation directly. Tell them what you opened and whether you entered any information. If you used a work or school account on the device, notify that organization too.
Do not rely on a single scan or a reassuring-looking result as proof that everything is safe. A scan may be one part of an assessment, but it cannot, by itself, establish what happened or resolve every concern. Ask the person helping you what to do next and whether you should use another device for important account activity while they assess the situation.
If you entered a password or shared information
Tell your administrator or security professional exactly what you entered and where. If a work or school account was involved, use the organization’s procedure for suspected credential exposure. Do not send passwords or one-time codes in an email or chat message as part of the report.
If you need to change a personal account password, use the provider’s official sign-in route from a device and connection you trust. Do not follow a password-change link from the suspicious message. Ask for help if you are unsure whether a page or request is genuine.
Confirm the handoff, not a diagnosis
You have completed the immediate handoff when the appropriate support contact confirms they received your report and tells you what to do next. Keep their instructions and your notes together, and follow any later requests. If you receive no acknowledgment, use another known contact route to check that the report reached the right team.
A quiet device or the absence of an obvious warning does not prove that nothing happened. Equally, opening a file does not prove that the device was compromised. Let a qualified person assess the available information, and avoid making changes based on assumptions while that assessment is underway.
- Stop interacting with the attachment; do not reopen or forward it.
- Record what you saw and did, including any information you entered.
- Report through a known workplace or school channel, or consult a trusted security professional.
- Follow the guidance you receive and confirm the support contact has your report.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction