Decide Whether a Scanned Attachment Is Safe Enough to Open

Read the scan result narrowly

A scan can help detect certain threats, including threats the scanning system already recognizes. Its result describes what that scan did or did not identify; it cannot establish that every part of a file is safe. A clean result therefore lowers neither your need for judgment nor the importance of checking the message itself.

If a mail service shows a warning or says it could not scan an attachment, take that information seriously. Do not assume that an unavailable or incomplete scan means the file passed. If the result is unclear, leave the attachment unopened and seek clarification through a trusted channel.

Check whether the message fits

Ask whether you were expecting this particular file from this particular person, and whether the message fits the conversation you were already having. A familiar display name is not enough by itself: messages can appear to come from someone you know, and accounts can be used in unexpected ways.

Look for a mismatch between the attachment and the explanation. For example, a message that claims to be a routine document but gives no context, creates unusual urgency, or asks you to take an unrelated action deserves extra caution. Do not let a polished message or a clean scan substitute for a plausible reason to receive the file.

Verify through a separate route

For an unexpected or sensitive attachment, contact the sender using details you already trust, such as a previously used phone number or a separate conversation. Ask whether they sent that specific file and whether they intended you to take the requested action. Avoid relying on contact details supplied only in the questionable message; if the message is deceptive, those details may lead back to the sender of the deception.

A short confirmation should be specific. Confirm the file or its purpose, not merely whether the person sent you “something.” If you cannot verify it, or the sender does not recognize it, do not open it. Follow your organization’s established process for reporting suspicious messages if one applies.

Be wary of requests to run or enable

Opening a document to read it is different from following instructions inside it. Treat requests to run a downloaded file, enable active content, change security settings, or provide credentials as a separate decision that needs a clear, verified reason. A scan result does not make those actions safe.

If a file asks you to take one of these steps unexpectedly, stop. Verify the request with the sender through a separate route and, for a work device, check with the appropriate support or security contact. Do not enter a password or one-time code into a page opened from an unexpected attachment or message.

A practical decision check

Suppose you receive an unexpected invoice attachment from a supplier. The message says it is overdue and instructs you to open the file and enable content to view the details. Even if a scan reports no known issue, the urgency and instruction are reasons to pause. Use the supplier contact you already have—not a number or link in that message—to confirm the invoice and the requested steps.

Before opening, ask:
• Did I expect this specific attachment?
• Does the sender and context make sense?
• Is the scan result clear, or is there a warning or limitation?
• Does the message ask me to run, enable, or disclose anything?
• Can I confirm the request through a trusted, separate channel?

Confirm your decision without overclaiming

If the attachment was expected, the sender and purpose are independently confirmed, and no suspicious action is being requested, you can make a more informed decision about whether to open it. Keep ordinary caution in place; those checks reduce uncertainty but still cannot certify the file as harmless. If doubt remains, do not proceed just to meet a deadline.

You have completed the check when you can explain why the file was expected, how you verified the sender and request, and what the scan result actually says. If any answer is missing or inconsistent, leave the file unopened and ask for a safer way to receive the information.