A Safe Checklist Before Downloading an Email Attachment

An attachment can be dangerous even when its filename looks ordinary, the message uses a familiar logo or the sender's domain passes email authentication. Before downloading, decide whether the file was expected, whether you can verify the request independently and whether the device and software you plan to use are appropriate for the risk.

Once Email receives attachments but does not send mail and does not claim to scan files for malware. A displayed filename, MIME type or download link is descriptive metadata, not a safety verdict.

1. Stop if the attachment was not expected

Ask what real event should have produced the file. Did you request an export, apply for the document, open a support case or agree that this person would send it? Urgency is not evidence. An unexpected invoice, delivery notice, résumé, legal threat or “security report” should be treated as unverified even when the topic feels plausible.

Microsoft's phishing protection guidance advises users not to open suspicious links or unexpected attachments and to contact the organisation through official contact information. Do not reply to the message and ask whether it is real if the mailbox or sender account itself may be compromised. Use a phone number, application or website you already trust.

If you cannot explain why the file arrived, the safest download is no download.

2. Verify the sender through a separate channel

The visible display name can be copied. A From address can be forged, and a genuine account can be compromised. SPF, DKIM and DMARC results provide useful domain-level evidence but do not certify the sender's intent or the attachment contents.

For an important file, confirm with the sender using an established conversation or known contact method. Ask for the purpose and expected filename, not a password or secret. If a company supposedly sent the document, open its official site or application independently instead of using a link in the same message.

The email authentication guide can help you interpret header results, but a passing result never replaces this contextual check.

3. Read the full filename, not just the icon

Enable display of complete filenames and extensions in the operating system. Attackers can use long names, repeated spaces, right-to-left characters or multiple extensions to make an executable resemble a document. A file named statement.pdf.exe is an executable regardless of the PDF word in the middle.

Treat executable and script-capable formats as high risk, including platform-specific installers, scripts, shortcuts and disk images. Office documents and PDFs are not automatically harmless: they can contain active content, links or exploit malformed file parsers. Archives can conceal the real file type and may be password-protected specifically to prevent a mail provider from inspecting their contents.

Do not rename a blocked file to force it open. A mail client warning is a reason to verify the delivery method with the sender or security team, not a puzzle to bypass. Microsoft documents that Outlook blocks attachment types considered potentially unsafe; the exact block list is product-specific and should not be treated as a complete malware list.

4. Compare metadata, but do not trust it alone

The message may declare a MIME type such as application/pdf, while the downloaded bytes represent another format. The filename extension and declared type can both be incorrect or intentionally misleading. A file-size value is also not proof: a tiny script can be harmful, while a large archive may merely be inconvenient.

Use metadata to find inconsistencies, not to certify safety. If an expected PDF is described as an executable, or the sender expected one image but the message contains an encrypted archive, stop and verify. Once Email displays attachment information supplied through the received message; it does not guarantee that the data matches the file's true format.

5. Protect the device before saving or opening

Keep the operating system, browser, document viewer and security software current. Save the file without automatically opening it. Scan it with the security controls approved for the device or organisation, and follow any quarantine warning.

A clean scan reduces known risk but does not prove a file is safe. New or targeted malware may not be detected, and online scanning services may retain or share uploaded samples. Do not upload a confidential contract, personal record, source archive or customer file to a public scanner without authority and a clear data-handling policy.

For higher-risk authorised analysis, use an organisation-managed isolated environment and involve the security team. A personal computer, production server or device holding valuable credentials is not an appropriate malware laboratory. Do not execute a suspicious file merely to see what it does.

6. Consider whether you need the file at all

Many legitimate services provide the same document inside a signed-in portal. Retrieving it from the known application can be safer than opening an email attachment. Ask whether a plain-text summary, protected file share or newly generated export would meet the need.

If the attachment contains a verification code or temporary record, save only the minimum information needed and respect its retention requirements. The email test evidence guide explains why copying a complete .eml message or mailbox export can expose unrelated headers, tokens and personal data.

7. Report suspicious mail without spreading the file

Use the mail provider's phishing or abuse-reporting function when available. In a workplace, follow the security team's reporting channel. Do not forward a suspicious attachment casually to colleagues; forwarding can create more copies and more opportunities to open it.

Record a minimal description: when it arrived, the claimed sender, why it was unexpected, the filename and the warning shown. Redact recipient addresses, tokens and internal identifiers before placing evidence in a broadly visible ticket. Preserve the original message only according to an authorised incident process.

If you already opened the file and the device behaves unexpectedly, disconnect from sensitive work as your organisation directs and contact its security support. Do not hide the event or continue entering passwords while investigating alone.

Download decision

Download only when you expected the file, verified the sender through a trusted route, understand the complete filename and format, and have an appropriate patched environment for handling it. Stop when the message creates urgency without context, the file type conflicts with the request, a client blocks it or the only way forward is to weaken a security control.

An attachment arriving successfully proves delivery, not safety. The goal of the checklist is not to predict every malicious file; it is to avoid turning an unverified message into code or active content on a device you care about.