How to Tell If an Email Attachment Is Safe to Open
Attachments are one of the easiest ways harmful software reaches a computer, because opening a file feels harmless. Most attachments are fine — the skill is telling the safe ones from the risky ones before you double-click, using the sender, the file type, and the context of the message.
Follow these steps
- Check who really sent it. Look at the sender's name and address, not just the display name. An attachment from someone you know, at an address you recognise, is a very different thing from the same file sent by a stranger or a lookalike address.
- Ask whether you were expecting it. Were you waiting for this document, invoice, or photo? An unexpected attachment — especially one with urgent wording or a vague message — deserves suspicion, even if it claims to come from a company you use.
- Look at the file type before opening. Documents, images, and PDFs are the usual safe formats, but treat executable files, scripts, and files with double extensions with suspicion. If a file ends in a program or script type you did not expect, do not open it.
- Preview instead of downloading when you can. Many email apps let you preview a document or image without downloading it. Use the preview first: if the content does not match what the message promised, delete the email without downloading anything.
- Verify surprising attachments through another channel. If an attachment is unexpected but claims to come from someone you know, check with them another way — a message or a call on a number you already have — before opening it. A hacked account can send dangerous files to its whole contact list.
- Scan it if you are still unsure. If you decide to download it, let your device's built-in security scan run over it first, and only open it if the scan is clean and everything else checks out. When in doubt, delete it and ask the sender to resend it.
What NOT to do
- Do not open an attachment from an unexpected email just because the message sounds urgent.
- Do not open executable or script files sent by email, even from a familiar-looking name.
- Do not enable macros or extra content in a document unless you were expecting that document and trust the sender.
- Do not download an attachment to check what it is if every other sign already looks wrong — delete it instead.
Most attachments you receive will pass these checks easily, and the few that fail them are exactly the ones worth deleting. A minute of checking beats a long cleanup afterwards.