An archive can look like a single ordinary attachment while containing several files, nested folders, or items whose names tell you little about their purpose. That makes an unexpected ZIP or other compressed file harder to assess from the message alone. It may be legitimate, but a familiar sender name is not enough to confirm that the file was intended for you. Before extracting anything, verify the request through a communication channel you already trust, then follow your organisation’s approved process for handling attachments. A short pause can prevent a risky guess.
The useful bits
- Treat an unexpected archive as unverified, even if the sender appears familiar.
- Confirm the exact file and reason through a known channel, not just the message that carried it.
- Use your organisation’s approved process and report uncertainty rather than bypassing controls.
Why one attachment can conceal a lot
Compressed archives bundle files together and may reduce their size. Until the contents are viewed, the message’s attachment label may not reveal what is inside. An archive might hold a document you were expecting, but it could also contain unrelated files, several versions of a document, or another compressed file. The sender’s short description cannot confirm the contents.
This is why the question is not simply whether you recognize the sender. A genuine account can be used unexpectedly, and a message can be misleading about what an attachment contains. Neither possibility proves that a particular archive is harmful; it means you should verify before opening it.
Verify the request outside the message
Contact the person using details you already have, such as a known work number or an existing conversation in a trusted channel. Do not rely on a phone number, link, or reply address supplied only in the unexpected email. Ask whether they sent the archive, whether they intended it for you, and what it should contain. If the explanation is vague, inconsistent, or cannot be confirmed, do not extract it.
Be specific. Confirm the filename and the reason you are receiving it, not merely whether the person sent “a file.” If the archive is for a work task, check with the relevant colleague or team through an established channel. A familiar name in the email is not a substitute for confirmation.
Unexpected email: “Please open this archive today.” Known-channel check: “Did you send an archive named [filename], and what files should I expect inside?” If they cannot confirm both the file and its purpose, leave it unopened and use your organisation’s reporting process.
Follow your organisation’s approved route
Workplaces may have specific rules for reviewing attachments, reporting suspicious messages, or asking an IT or security team for help. Use the process your organisation has approved, including any required tools or restrictions. Do not try to work around a warning or policy because a deadline feels urgent. If you are unsure which process applies, ask through a known internal channel before acting.
A scan or other security check can be one part of an approved process, but it is not proof that every file is safe. No single check can establish that an unknown archive is harmless in every situation. If the process says not to extract it, stop there—even if you have a reason to think the sender is legitimate.
If verification checks out, still inspect with care
Once the sender and purpose are confirmed, use the method your organisation permits to inspect the archive. Review the filenames and file types before opening individual items. Ask whether each item makes sense for the task. A file that does not match the explanation, an unexpected nested archive, or a request to enable active content is a reason to pause and check again.
Do not assume that a familiar-looking filename makes a file safe, and do not open everything simply because it arrived in one bundle. If your organisation’s approved process does not allow you to inspect the archive yourself, hand it to the designated support or security contact instead.
A quick pause-before-extract checklist
Before extracting an unexpected archive, make sure you can answer these questions clearly. If any answer is no or uncertain, stop and ask for help rather than guessing.
- Was I expecting this file, or did I confirm the sender intended it for me?
- Did I verify the filename and purpose through a channel I already trust?
- Does the approved process allow me to inspect this archive, and do I know how to report a concern?
- Do the contents and file types match what the sender described?
If you already extracted it
Do not open additional files or try to investigate by launching them. Follow your organisation’s incident-reporting instructions promptly, and tell the support or security contact what you received, whether you extracted it, and what you opened, if anything. Keep the message and relevant details available as your organisation’s process permits; avoid deleting or forwarding material unless instructed.
If this was a personal device and you are concerned, use the security support available for that device and avoid opening more contents while you seek guidance. Be clear about what happened rather than trying to conceal a mistake. The useful confirmation is that you have stopped interacting with the files and have reached the appropriate support channel—not that a quick scan or a plausible filename settled the question.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction