Before You Open an Email Attachment: What to Check

What to Check Before You Open an Email Attachment

The standard advice about attachments stops at being careful with files from people you do not know. That covers almost none of the attacks that actually work on small companies. The invoice that infects a business usually arrives from a real supplier, inside a conversation that has been running for weeks, with the right logo and the right signature block. What tells you more, before you open an email attachment, is what the message is asking you to do with the file once it lands.

Your filter is good, and a real share still gets through

Your email service already blocks most of what arrives. One security company, which opens suspicious files inside a sealed container on the computer so it can watch what they do, reported that at least 11% of the email threats it caught in the first three months of 2026 had already passed through one or more email scanners on the way in. Roughly one in nine landed in somebody’s inbox looking perfectly clean.

Buying more filtering does not close that gap, because the last few percent are the ones designed to survive filtering. That is why the ten seconds before you open an email attachment still belong to you and your team.

The file types doing the work now

Over the same three months, the files carrying malicious code broke down roughly as follows. Programs, meaning files that run something on your machine the moment you open them, accounted for 39%. Compressed folders, the zip files and their cousins, accounted for 38%. Documents in PDF form accounted for 10%.

Two things follow for a business owner. The first is that the dangerous file is often wrapped inside a second file, so what appears in the message is a harmless looking folder and what sits inside it is a program. The second is that no format is safe by category. The same researchers documented ransomware delivered as a Windows shortcut wearing the icon and the name of a Word document, and a campaign that hid its payload behind a fake confirm you are human box inside a PDF.

What to check before you open an email attachment, in about ten seconds

1. Were you expecting this file? Most legitimate attachments answer something you asked for, so before you open an email attachment that arrived unprompted, especially one about money, give it the extra ten seconds no matter who appears to have sent it.
2. Read the real address, not the name above it. On a phone, the sender’s actual address is hidden behind a display name, and one tap reveals it. A supplier you have worked with for years should be writing from the same address as always.
3. Look at what the file actually is. The name can say Invoice_4471.pdf while the file itself is a program. If the name carries two extensions, or ends in something you do not recognize, that is where you stop.
4. Notice what the message wants from you emotionally. Payment details that changed since last month, a deadline that happens to be today, a request to keep the matter between the two of you. Those three appear in almost every successful invoice fraud.

The three requests that should stop you every time

Three requests in particular should stop you before you open an email attachment, whatever the name on the message says.

The first is a password to open the attached folder, helpfully supplied in the same email. Real senders rarely do this, and attackers do it precisely because the password prevents your scanner from seeing what is inside.

The second is a prompt to enable content or enable editing once the file is open. That prompt exists because Microsoft switched the risky behavior off by default, and clicking it switches the protection back off on your behalf.

The third is any instruction to prove you are human by copying something and pasting it somewhere else on your computer. Several current campaigns use a convincing verification box, and what you paste is a command that installs the software for them. Nothing legitimate has ever asked an employee to do that.

What to do if you open an email attachment you should not have

1. Tell whoever handles your IT immediately, before you try anything else. Nobody has ever made an incident worse by reporting it too early.
2. Disconnect that computer from the network by unplugging the cable or switching off the wifi, and leave the machine running.
3. From a different device, change the password of the account used on that computer and sign out of every open session.
4. Call your bank directly if anything on screen touched payment details, using the number on your statement rather than the one in the email.
5. Ask your provider to check whether a forwarding rule was created on the mailbox. Setting one up is among the first things an attacker does, and it is what lets them read your mail for months afterwards.

Post those five lines somewhere your team can find them. A person who knows what happens next reports faster, and the delay between the click and the phone call is what turns a contained incident into an expensive one.

The part that should not be on you

Everything above happens at the very end of the chain, once the message has already reached somebody’s screen. Ahead of your staff there should be a system that judges a file by what it does when opened rather than by recognizing something already known to be bad, monitoring that flags an unusual sign-in or a new mail rule outside working hours, and a backup somebody has actually restored from this year.

If the decision to open an email attachment is the only thing standing between a convincing invoice and your accounting system, the problem is not your team.

What this changes for a business around Augusta

Companies across Columbia County and the wider Augusta area sit inside long supplier chains, much of it tied to the defense sector, and that is exactly the setting invoice fraud is built for. An attacker who reads one supplier’s mailbox for a few weeks learns your billing cycle, your contacts and your tone before writing anything.

That exposure also shows up on paper. Customer security questionnaires and insurance renewals now ask how staff handle suspicious messages and how quickly an incident gets reported, and a loose answer is something you have to defend later. Common questions on this come up often enough that we keep answers on the frequently asked questions page.

The questions to ask your IT provider

1. What happens on our system when somebody opens a file nobody has ever seen before?
2. Are attachments being blocked today, and who reads the report on that?
3. If somebody opens a bad file at eight on a Friday evening, who finds out, and when?
4. Can our team report a suspicious message in one click, and where does that report go?
5. When did we last restore a real file from backup, and how long did it take?