A document that will not display properly until you click “Enable Content” is asking you to run something, not simply view a page. That request may be legitimate in some work processes, but an unexpected attachment is not a good reason to take the risk. Pause before clicking, especially if the message creates urgency or asks you to bypass a warning. You can check whether the sender really sent the file, find out whether its active features are necessary, and look for an approved way to view it without enabling them.
The useful bits
- Do not enable macros or other active content just to open an unsolicited document.
- Confirm the attachment through a contact method you already trust, not by replying to the message.
- Use an approved viewing method and report the message if you cannot verify it.
Treat the prompt as a request to run code
Macros and other active content can make a document perform actions beyond showing its text or images. A prompt to enable them is therefore a meaningful security decision. The document’s appearance, familiar branding, or file name does not establish that its contents are trustworthy.
Do not enable content simply because the document says it is required, appears to come from a colleague, or has been sent as part of a routine-looking conversation. A compromised account or a misleading sender name can make a message look convincing. The appropriate choice depends on whether you expected the file and can verify its purpose—not on whether the prompt is persuasive.
Pause and check the message for context
Ask whether you were expecting this specific document, whether the sender normally shares this kind of file, and whether the request makes sense in the current conversation. Be cautious if the message urges you to act immediately, claims an account or payment will be affected, or gives unusual instructions for getting around a warning.
Look at the actual sender address and the surrounding conversation, but do not treat those details as proof. A familiar display name or an existing email thread can still be misleading. Avoid opening the attachment again while you are deciding what to do.
Verify with the sender through a separate route
Contact the person using a phone number, messaging account, or other contact method you already know is theirs. Do not use a phone number or link supplied only in the suspicious email, and do not rely on replying to that message: an attacker may control the account or conversation.
Ask a focused question: did they send this particular file, did they intend it to contain active content, and is that content necessary for your task? If they did not send it, or cannot confirm it, do not enable anything. Follow your workplace’s established process for reporting suspicious messages.
Message sent to a known contact method: “I received a document from [sender address] called [filename] that asks me to enable content. Did you send it, and is there an approved way for me to view it without enabling that content?”
Choose a viewing method approved for your situation
If the sender confirms the file, that still does not automatically make it appropriate to enable active content. Ask whether they can provide the information in a form your organization has approved for viewing, or whether a trusted internal process can handle the file. Use the method recommended by your organization’s security or IT team.
Do not assume a different file format, a preview, or a conversion is inherently safe. Each method has its own limits, and the right option depends on the tools and policies available to you. If no approved method is clear, request guidance rather than experimenting with the attachment or lowering security settings.
A quick decision checklist
Before taking any further action, make sure you can answer these questions. If an answer is uncertain, keep the content disabled and ask your organization’s designated support or security contact what to do.
- Was I expecting this specific file and its active features?
- Did I verify the sender through a contact route I already trust?
- Is there an approved viewing option that does not require enabling content?
- Do I know how to report the message if the sender or purpose cannot be confirmed?
If you already enabled it
Stop interacting with the document. Close it if you can do so normally, and contact your organization’s IT or security team promptly using its established reporting route. Tell them what you opened, what you clicked, and roughly when; do not omit details because you are worried you made a mistake. Their instructions should guide any next steps.
Do not forward the attachment to coworkers as a warning or try to investigate it yourself. If the message arrived in BITTU Mail, use your organization’s approved reporting process if one exists; available controls can depend on your role, plan, and workspace configuration. If you cannot find the right route, contact the responsible administrator or support channel.
Confirm the issue is resolved
You have handled the immediate decision when you have kept the content disabled, independently confirmed the file or established that it is unverified, and either used an approved viewing method or reported it for guidance. If you reported it, follow up through the organization’s normal channel to learn whether you should delete the message, retain it for review, or take another action.
If the sender cannot confirm the attachment, treat that uncertainty as unresolved rather than as permission to proceed. A clear confirmation and an approved viewing path—not a successful-looking preview—are the practical checks that tell you what to do next.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction