Direct answer
Do not open an unexpected attachment to decide whether it is safe. Verify the request independently and use the organization's reporting process; if the file was downloaded or opened, tell responders exactly what occurred.
Verify the request independently
A familiar sender can be impersonated or compromised. Contact the person using an established channel and confirm that the file and request were expected. Do not use a telephone number supplied only in the suspicious message.
Reference: CISA: Recognize and report phishing.
Preserve without executing
Use the mail system's reporting function or follow the security team's instructions for preserving the original message. Do not enable macros, run the file, upload it to an unfamiliar website or forward it widely to ask whether it is safe.
- Record the message time and claimed sender.
- Separate a preview, download, opening and execution.
- Protect sensitive message content and recipients.
Escalate an interaction
If a file was opened or software ran, notify the device owner and security team promptly. They can decide whether to isolate the device, preserve evidence and review activity. Avoid deleting evidence or performing ad hoc cleanup that conflicts with the incident plan.
Reference: NIST SP 800-61 Rev. 3: Incident Response.
Understand link-tool limits
A URL review tool does not establish the safety of a file attachment. A message can include both a benign-looking link and a harmful attachment, so assess each part through the appropriate authorized workflow.
Assessment limits
A filename or extension alone cannot establish safety, and response depends on what was executed and the device environment. Follow the organization's incident and evidence procedures.
Frequently asked questions
Is a file safe because the sender is familiar?
No. The account may be spoofed or compromised; verify the expected file independently.
Should I open it in a normal browser to check?
No. Give the message to authorized responders using the approved reporting process.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.