Safe Ways to Open Files You Are Unsure About
When you are unsure about a file but need to see it, there are safer ways: ask the sender, use preview modes, open in the browser, scan it, or ask IT. A practical guide.
Sometimes you genuinely need to see a file but you are not sure about it: an invoice from a new supplier, a CV from a candidate, a document from a colleague you were not expecting. You do not have to choose between blind trust and ignoring it. There are safer ways.
Safer options, from best to good
- Ask the sender through another channel whether they sent it and what it is.
- Ask them to share it differently, such as through your organization's file-sharing system or a portal you use.
- Preview it in webmail or the email app's preview, rather than downloading and opening in a desktop program.
- Stay in Protected View for Office files; never click "Enable Content". See the macro warning.
- Scan it with your security software before opening.
- At work, ask IT to check it.
Files to leave alone
- Programs, scripts, shortcuts and disk images from email. See dangerous attachments.
- HTML attachments. See HTML attachment phishing.
- Password-protected archives you did not expect. See protected zips.
Turn on "show file extensions" on your computer so you can see a file's real type, such as .exe hidden behind .pdf.
Good habits for teams that receive files
- Recruiters: ask candidates to upload CVs through your careers portal. See phishing aimed at HR.
- Finance: receive invoices through a known supplier portal or shared inbox with checks.
- Everyone: report files that seem wrong.
Unsure about an email with a file? Paste its text into CyberWatch AI Scan for a free check.
For more, see how phishing works in our complete guide.
Frequently asked questions
Is previewing an attachment safe?
Previews in webmail or your email app are generally safer than opening files in desktop programs, though not risk-free. Avoid previewing files you strongly suspect.
What is Protected View?
A read-only mode in Office that opens files from the internet without running macros or editing. Stay in it for files you are unsure about.
Can I upload a file to an online scanner?
You can, but do not upload files containing sensitive or confidential information to public scanners. At work, ask IT.
Sources
- Suspicious email actions, UK National Cyber Security Centre
- Malware: How To Protect Against, Detect, and Remove It, US Federal Trade Commission
- Device security guidance, UK National Cyber Security Centre
