Downloads & Email Attachments
Opening an infected file is one of the easiest ways to get malware, ransomware or a stolen password. Attachments and downloads often look like invoices, shipping notices, résumés, safety documents or software updates. Learning which files are risky, and how to check before you click, protects your phone, your computer and your job.
- Everyone
- Office & Field
- Small Business
How bad files get to you
- Email attachments that pretend to be invoices, purchase orders, bid requests, shipping notices, résumés, timesheets or “scanned documents.” See Phishing Emails and Invoice Fraud.
- Text and messaging links that download a file. See Text Message Scams.
- Fake software updates and pop-ups on websites that say your device is infected. See Tech Support Scams.
- Free downloads such as pirated software, cracked apps, game cheats, free PDF tools and fake “codecs.”
- QR codes that lead to a malicious site or download. See QR Code Scams.
- USB drives found or given to you. See Safe Browsing.
- Hacked accounts: a message from a friend or coworker whose email was taken over. See Email Account Security.
Risky file types
| Type | Why it’s risky |
|---|---|
| .exe, .msi, .scr, .bat, .cmd, .com, .jar, .vbs, .js, .ps1 | Programs and scripts that run code when opened. Almost never sent legitimately by email |
| .zip, .rar, .7z, .iso, .img | Compressed or disk image files that hide dangerous contents. Password-protected zips can slip past scanners |
| .docm, .xlsm, .pptm and other Office files with macros | Macros are small programs inside documents. Criminals ask you to “enable content” or “enable editing” |
| .pdf, .html, .htm | Can contain links to bad sites or fake login pages, and sometimes malicious code |
| .lnk, .url | Shortcuts that launch commands or websites |
| .apk (Android) | Apps installed outside the official store can carry malware |
Even a normal-looking file like a PDF or a photo can be dangerous if it comes from an untrustworthy sender or if it’s been tampered with. The safest assumption is that any unexpected file could be bad.
Tricks to watch for
- Double extensions, such as invoice.pdf.exe. Your computer may hide the real ending. Turn on “show file extensions” in settings.
- Urgency and fear: “Your account will be closed,” “Payment overdue,” “Package could not be delivered.”
- Unexpected from someone you know: a coworker sends a strange message with just a file or link, or an odd subject. Their account may be hacked.
- Generic greetings and odd wording, or a reply to a message you never sent.
- Requests to enable macros, disable antivirus or turn off protections.
- Shared document links that ask you to log in with your email password, which are phishing pages made to steal your credentials.
- Pretending to be a known company but with a sender address from a strange domain.
Before you open or download
- Stop and think. Were you expecting this file? From this person? Does it make sense?
- Check the sender’s real address (tap or hover to see it), not just the display name. Look for small misspellings.
- Verify by another method. Call or message the sender using a number you already have, not one from the email, and ask if they sent it.
- Hover over links to see where they go before clicking. On a phone, press and hold the link. When in doubt, type the website address yourself.
- Don’t enable macros or editing in an unexpected document.
- Scan the file with your antivirus or security software before opening it. Use your employer’s tools if provided. See Safe Browsing.
- Open on a protected device. Keep your system and apps updated. See Software Updates.
Safer downloading habits
- Download apps only from official app stores (Apple App Store, Google Play) or the software maker’s own site.
- Keep your operating system, browser and antivirus up to date, with real-time protection on.
- Use a standard user account, not an administrator account, for daily work, so malware has fewer rights.
- Keep backups of important files, offline or in a protected cloud service. See Backups and Ransomware.
- Use strong passwords and two-factor authentication so a stolen password isn’t enough. See Two-Factor Authentication.
- Ask your employer or IT team about attachments you’re unsure of, and report suspicious emails.
- Don’t download cracked software, pirated movies or “free” versions of paid programs.
- Don’t plug in unknown USB drives.
- Don’t click “Allow” or “Install” on pop-ups you didn’t ask for.
- Don’t forward suspicious files to coworkers.
If you opened a bad file
- Disconnect from Wi-Fi and unplug the network cable. Turn off your device’s connection to stop the spread.
- Tell your employer’s IT or your manager right away, and don’t keep working.
- Run a full security scan, and follow IT’s instructions. Don’t restart or delete things unless told.
- Change your passwords from a clean device, especially email, banking and work accounts. See What to Do if Your Account Is Hacked.
- Watch your accounts and consider a credit freeze if personal data may have been taken. See Credit Freeze and Identity Theft.
- Report it. See Reporting Cybercrime.
Attachment checklist
- I was expecting this file from this sender, or I verified it another way
- I checked the real sender address and the full file name and extension
- I haven’t been asked to enable macros or turn off security
- The file was scanned, and my device and apps are up to date
- I downloaded software only from official sources
- I know who to tell if something goes wrong
Standards & references
Last updated: