Are Email Attachments Safe? How to Handle Files From Unknown Senders

Email attachments are usually safe when they come from a sender you know and expected, but files from unknown senders remain one of the most common ways malware and phishing reach people. The practical rule is simple: verify the sender, understand the file type, and never run, enable or extract anything you were not expecting. This guide explains exactly how to do that, step by step, with the technical detail behind each check.

Email attachment safety is the set of habits and technical controls that stop a file sent by email from harming your device, your accounts or your data. It covers three things: deciding whether a message is genuine, judging how dangerous a particular file type is, and opening files in a way that limits damage if something is wrong.

Key takeaways

• The file type matters more than the file name. Executables, scripts, shortcut files, disk images and macro-enabled documents carry far more risk than plain images or text.
• Reading an email is rarely the problem; acting on it is. The danger usually starts when you open, extract, run or "enable" something.
• Display names prove nothing. Check the actual sending address, the reply-to address and whether the message fits a real conversation.
• Containers hide content. ZIP, RAR, 7z, ISO and IMG files can hide dangerous files from scanners, especially when password-protected.
• "Enable Content" is a decision, not a formality. A document that needs macros or editing to "display correctly" is a major warning sign.
• A disposable inbox protects your address, not your device. Using a temporary address keeps your real inbox out of spam lists, but you still need to treat downloaded files carefully.
• Have a plan for mistakes. Knowing what to do in the first ten minutes after a bad click limits the damage.

Why are email attachments used to spread malware?

Attackers like attachments because they combine two things: a delivery channel that reaches almost everyone, and a file that the recipient opens by choice. Email filters cannot simply block every file, because people legitimately send invoices, CVs, contracts, photos and reports every day. That gap between "files people need" and "files that are dangerous" is where malicious attachments live.

A malicious attachment typically tries to do one of four things:

1. Run code directly. An executable or script runs as soon as you double-click it, with your user permissions.
2. Trick an application into running code. A document uses macros, embedded objects or a software vulnerability to start a hidden process.
3. Send you somewhere else. A PDF, HTML file or document contains a link or button that leads to a fake login page. The file itself may be clean; the destination is the attack.
4. Collect information. An HTML attachment opens a local page that imitates a sign-in screen and sends whatever you type to the attacker.

Understanding which of these a file could do is the core of judging risk. A JPEG photo cannot run code on its own in an updated viewer. A Windows shortcut file can. That difference is why the next section matters so much.

Which file types are most dangerous?

File risk is about what the operating system will do when you double-click the file. Some formats are passive data that a program displays; others are instructions that a program executes. The table below groups common attachment types by typical risk when they come from an unknown or unexpected sender.

Two points are easy to miss. First, risk is about context: a .xlsm file from your accountant during tax season is normal, while the same file from an unknown address about a "missed delivery" is not. Second, the extension you see may not be the real extension, which brings us to file name tricks.

How do attackers disguise file types?

Several long-standing tricks make a dangerous file look like a harmless one:

• Double extensions. A file named invoice.pdf.exe appears as invoice.pdf when the operating system hides known extensions, which Windows does by default. Turn on "File name extensions" in File Explorer's View menu so you always see the real ending.
• Long names with padding. A name like statement.pdf .js pushes the true extension off the visible area of a narrow column.
• Right-to-left override characters. A Unicode control character (U+202E) can reverse the order in which the rest of a file name is displayed, so a name ending in "fdp.exe" can be shown with the letters in a misleading order. Many mail services now flag or block such names, but it is a reason to read the file type column, not just the name.
• Familiar icons. Executables and shortcuts can carry any icon, including a PDF or Word icon. An icon is decoration, not proof.
• Misleading MIME types. An email declares a content type for each attachment (for example application/pdf), but that label is chosen by the sender. What the file actually does depends on its real format and extension on your device.

The fix for all of these is the same: look at the real file type before opening. On Windows, enable visible extensions and check the "Type" column or the file's Properties. On macOS, use "Get Info". On mobile, the share sheet or file manager usually shows the real type.

How do I check whether the sender is real?

Most dangerous attachments arrive with a believable story: an invoice, a shipping notice, a shared document, a voicemail, a job application, a legal notice. The file is only half of the attack; the message that convinces you to open it is the other half. Checking the sender is therefore the first filter.

Step 1: Read the real address, not the display name

Every email has a display name (for example "Accounts Department") and an address (for example billing@example-pay.net). The display name can be set to anything by anyone. On desktop, hover over or click the name to see the address. On mobile, tap the sender line. Look for:

• Domains that imitate a real brand with extra words, hyphens, or swapped letters (for example "rn" for "m").
• Free webmail addresses claiming to be a company's legal, billing or HR department.
• A domain that does not match the company's website you already know.

Step 2: Check the reply-to address

A message can come "from" one address and send replies to another. If the reply-to field points to a different domain than the sender, ask why. Legitimate newsletters and ticketing systems sometimes do this, but a personal-looking message about an urgent payment should not.

Step 3: Look at authentication results

Mail servers use three standards to check whether a message really came from the domain it claims:

• SPF (Sender Policy Framework) lets a domain publish which servers may send mail on its behalf.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature that proves the message was authorized by a domain and not altered in transit.
• DMARC tells receiving servers what to do when SPF or DKIM checks fail for a domain, and ties those checks to the visible "From" domain.

Many mail apps let you view the original message or headers ("Show original" in Gmail, "View message source" in others). Look for lines such as spf=pass, dkim=pass and dmarc=pass. A pass does not mean the message is safe; it only means it really came from that domain. Attackers register their own look-alike domains and pass authentication perfectly. A fail on a message claiming to be from your bank, however, is a strong warning sign.

Step 4: Does the message fit a real conversation?

Ask yourself three questions:

1. Was I expecting a file from this person or company, about this topic, right now?
2. Does the message use details only the real sender would know, such as an order number I can verify in my account?
3. Is it pushing urgency, secrecy or fear ("your account will be closed today", "do not tell anyone", "legal action")?

A "no", "no", "yes" pattern is typical of phishing. A related tactic is thread hijacking: attackers who have compromised one mailbox reply inside a real, old conversation with a new attachment. If an old thread suddenly revives with a generic "please see attached" and a file type that the person never sent before, confirm with them.

Step 5: Confirm through a separate channel

If anything is uncertain, contact the sender using contact details you already have, not the ones in the email. Call the number on the company's official website, message the colleague on your usual chat tool, or log in to the service directly by typing its address into your browser. If the invoice is real, it will be visible in your account there too.

What makes Office documents risky, and what does "Enable Content" really do?

Office documents deserve their own section because they are both extremely common and historically one of the most abused formats.

A macro is a small program written in VBA (Visual Basic for Applications) that is stored inside a document and can automate tasks. Macros can also download and run other programs, which is why they have been used by malware for decades. Modern formats separate the risk by extension: .docx and .xlsx cannot store VBA macros, while .docm and .xlsm can. Older .doc and .xls files can contain macros without an obvious clue in the name.

Two safety features matter here:

• Protected View. When Office opens a file that came from the internet, including email attachments, it typically opens it read-only in a restricted mode. A yellow bar offers "Enable Editing". As long as you stay in Protected View, the document is far more limited in what it can do.
• Macro blocking for internet files. Microsoft changed Office for Windows in 2022 so that VBA macros in files downloaded from the internet are blocked by default, showing a red security banner instead of an "Enable Content" button. This relies on the "Mark of the Web", a tag Windows adds to files that came from the internet.

Attackers responded with social engineering: documents that display a blurred image and a message such as "This document was created in a newer version. Enable editing and content to view." No real document needs you to enable macros just to be read. If a file from an unknown sender asks you to enable editing, content or macros, close it.

Attackers also moved to containers that, in some cases, did not pass the Mark of the Web to the files inside, such as certain disk images and archives. Updates have closed several of these gaps, but it is the reason why ISO and IMG attachments from strangers are treated as high risk.

Are PDFs, HTML files and images safe?

PDF files

PDF is mostly a display format, and the vast majority of PDFs are harmless. The realistic risks are:

• Phishing links. A one-page PDF with a logo and a button labeled "View secure document" that leads to a fake sign-in page. This is far more common than PDF exploits.
• Embedded files. PDFs can carry attachments of their own, which a viewer may offer to open.
• Scripts and vulnerabilities. PDFs can contain JavaScript, and PDF readers have had security flaws over the years.

Practical defenses: keep your PDF reader updated, consider opening unknown PDFs in a modern browser's built-in viewer, disable JavaScript in a desktop PDF reader if you rarely need it, and never sign in through a link inside a PDF you did not expect. If the PDF says "your document is ready, click to view", it is usually not the document; it is a doorway.

HTML and SVG attachments

An HTML attachment opens in your browser as a local page. That page can show a perfect copy of a sign-in screen pre-filled with your email address. Because the page is local, link-scanning tools in your mail service may never see a suspicious URL. HTML files can also build a file inside the browser from encoded data and offer it as a download, a technique known as HTML smuggling, which can slip a payload past filters that only inspect attachments.

SVG files are images defined in XML, and they can include scripts and links. Opened in an image viewer they behave like a picture; opened in a browser they can behave like a web page. Treat unexpected HTML and SVG attachments with the same suspicion as links.

A good rule: no legitimate company needs you to sign in from a file attached to an email. Sign in only by visiting the site directly.

Images

Ordinary JPEG, PNG, GIF and WebP files are passive data. The theoretical risk is a flaw in the image viewer, which is why updating your operating system and apps matters. The practical risk is different: an image may simply be bait, for example a "screenshot" of an invoice that tells you to call a phone number. The file is safe; the instructions in it are not.

How should I handle ZIP files and other archives?

An archive is a container that compresses one or more files. It is neither safe nor dangerous by itself; it is as safe as its contents. Archives are attractive to attackers for three reasons:

1. They hide the real file type until you open them, so the message only shows "documents.zip".
2. Password-protected archives cannot be scanned. Email security tools cannot see inside an encrypted archive. Messages that include an archive and the password in the same email are a classic pattern for exactly this reason.
3. Nested and unusual formats can confuse scanners, for example an archive inside an archive, or less common formats that some tools do not unpack.

Safe handling looks like this:

1. Do not extract archives from unknown senders at all unless you have confirmed the file through another channel.
2. If you must look inside, list the contents first without extracting. Most archive tools show a file list when you open the archive.
3. If the list contains executables, scripts, shortcuts or disk images, delete the archive.
4. Be very cautious with password-protected archives from anyone you have not spoken with about it. Legitimate senders who encrypt a file usually share the password through a different channel.

How do I open an attachment from an unknown sender safely?

Sometimes you genuinely need to look at a file from someone new: a job applicant's CV, a supplier's quote, a reply to a listing you posted. The goal is to see the content while giving the file as little power as possible. Here is a practical sequence, from least to most effort.

1. Decide whether you need to open it at all. If the file is unexpected and the story is generic, deleting is the safest action. Real senders follow up.
2. Check the real file type. Use the steps above. If it is an executable, script, shortcut or disk image, stop.
3. Use the mail service's preview. Webmail services often render PDFs, images and Office documents as previews on their own servers, so the file is displayed rather than run on your device. Preview first and only download if needed.
4. Open documents in a cloud viewer or read-only mode. Opening an Office file in a web-based office suite, or staying in Protected View, limits what the file can do. Do not click "Enable Editing" or "Enable Content".
5. Scan before opening. Let your security software scan the file. For files that contain nothing private, a multi-engine online scanner can give a second opinion. Remember that many such services share uploads with researchers, so never upload confidential documents.
6. Use an isolated environment for anything unusual. Tools such as Windows Sandbox (available in Pro and Enterprise editions of Windows), a virtual machine, or a separate spare device let you open a file where it cannot reach your real data. Close the environment afterward and nothing persists.
7. Convert when possible. If you only need the text, ask for it in the email body, or convert the document to PDF or plain text in a safe viewer before working with it.

A quick decision checklist

• Do I know and expect this sender? If not, slow down.
• Does the real address and domain match who they claim to be?
• Is the file type one I would expect for this topic?
• Is the file inside a container, especially a password-protected one?
• Is the message pushing urgency, secrecy, payment or sign-in?
• Does the document ask me to enable editing, content or macros?
• Can I verify through a separate channel before opening?

Two or more warning signs is enough reason to delete or verify first.

Is it safer to receive attachments on a phone?

Phones are different, not automatically safer. Mobile operating systems sandbox apps more strictly than traditional desktop systems, and Windows executables or scripts simply do not run on iOS or Android. That eliminates a large class of attachment threats.

Mobile devices have their own risks, though:

• APK files on Android. An Android app package sent as an attachment can be installed if you allow installation from unknown sources. Never install apps from email attachments; use official app stores.
• Configuration profiles. On iOS, profile files can change device settings such as VPN or certificates. Do not install profiles from unexpected emails.
• Phishing works just as well. PDFs and HTML files with fake login buttons are, if anything, harder to judge on a small screen where full URLs are hidden.
• Less visible detail. Mobile mail apps often hide the full sender address and file extension, so you have to tap to reveal them.

The same habits apply: check the sender, check the real file type, avoid signing in through links in files, and keep the operating system updated.

How does a disposable email address fit into attachment safety?

A disposable or temporary email address is an inbox you use for a short time and then abandon, so your real address is never exposed. It is a privacy and spam-control tool. It helps attachment safety indirectly and has clear limits, so it is worth being precise.

What a temporary inbox helps with

• Fewer unknown senders reach your real inbox. Much of the risky mail people receive starts with their address being shared with a site, leaked in a breach, or sold to a list. If you sign up for one-off downloads, forums or trials with a temporary address, those senders never learn your real one, so future phishing and malicious attachments go nowhere.
• Separation of contexts. When a file you requested from a website arrives in a temporary inbox, you know exactly why it is there. Unexpected attachments in your main inbox become easier to spot because there are fewer legitimate one-off messages mixed in.
• Testing. Developers and QA testers use temporary inboxes to check that their own application sends attachments correctly, without filling a personal mailbox.

What a temporary inbox does not do

• It does not make a dangerous file safe. Once you download a file to your device, the file-type rules above apply in full.
• It is not a place for confidential documents. Temporary inboxes are designed for short-lived, low-stakes mail, not contracts, IDs, medical or financial records.
• It is not a way to receive mail for important accounts. Banking, government services and primary social accounts need a permanent address you control for recovery.

How attachments work in VookMail

VookMail is a free temporary email service that creates an address automatically when the page loads, with no sign-up or password. You can type your own username and pick one of around 31 domains, or press the yellow shuffle button for a random address. Messages arrive in a real-time inbox, and attachments are supported, so you can receive the file you requested from a site.

On the delivery side, VookMail's domains have MX records that point to a mail delivery provider. That provider receives the message over SMTP and forwards it to VookMail over HTTPS, where it is shown in your inbox. The inbox displays the message and lists attachments; it does not execute files. When you download an attachment, it lands on your device like any other download, so the checks in this guide still apply. Messages and attachments are automatically deleted after about one day, so download anything you need promptly, and do not rely on the inbox as storage. The privacy policy and methodology page explain how mail is handled in more detail.

One practical feature for attachment safety is the QR code, which opens the same inbox on another device. If you prefer to view an unknown file on a phone or a spare device rather than your main computer, scan the QR code and open it there.

Common mistakes that turn a safe inbox into an infected device

• Trusting the display name. "IT Support" or a colleague's name means nothing without the real address.
• Hiding file extensions. Leaving extensions hidden is how report.pdf.exe looks like a PDF.
• Clicking "Enable Editing" out of habit. For files from unknown senders, Protected View is your friend.
• Extracting archives to see what is inside. List the contents first instead.
• Using the password supplied in the same email. This defeats the reason the archive was encrypted and blinds your scanners.
• Signing in from an attachment. Any file that leads to a login page should be treated as phishing until proven otherwise.
• Forwarding a suspicious file to a colleague "to check". This spreads the risk. Report it through your organization's phishing-report process instead.
• Uploading confidential files to public scanners. You may be sharing private data with third parties.
• Delaying updates. Many attachment exploits target flaws that have already been patched in current versions of Office, PDF readers, browsers and operating systems.
• Using a primary address everywhere. The more widely your real address is shared, the more unknown senders can target it.

Which settings reduce attachment risk on my devices?

You do not need specialist tools to raise your baseline. These settings are available on most systems and change the odds significantly.

For small teams and businesses

If you manage email for a team, a few additional controls help:

• Configure the mail service to block high-risk attachment types, such as executables and scripts, outright.
• Quarantine password-protected archives from external senders for review.
• Publish SPF, DKIM and DMARC for your own domain so attackers cannot easily spoof it, and use DMARC reports to see who is sending as you.
• Add a visible banner to messages from outside the organization.
• Give staff a one-click way to report suspicious mail, and make reporting a praised behavior, not an embarrassing one.
• Use shared document links from a trusted platform internally instead of attachments, so attachments from outside stand out.

Real-world attachment scenarios and how to respond

Principles are easier to apply with examples. Here are common situations and a sensible response to each.

"Your invoice is attached" from a company you do not use

The attachment is often an archive, HTML file or macro document. You have no account with the company, so there is no invoice to verify. Delete it. If it claims to be from a company you do use, log in to your account directly and look for the invoice there.

A shared document notification with an attached "preview"

Real file-sharing services send links, not attachments that require you to sign in. If the attachment is an HTML file showing a login page, it is phishing. Visit the sharing service directly to see whether anything was actually shared with you.

A CV or portfolio from a job applicant

This is a legitimate, expected file type from an unknown person, which is why attackers imitate it. Accept PDFs or standard documents, preview them in your mail service or a cloud viewer, and decline archives, macro documents, or links to unusual download sites. A real applicant can resend in a standard format.

A voicemail or fax notification with an attachment

Many phone systems do send voicemail as audio files, typically WAV or MP3. A "voicemail" that arrives as HTML, an archive or an executable is not a voicemail. Check your phone system's portal directly if you use one.

A file you requested from a website, received in a temporary inbox

You signed up for a template or a sample file using a temporary address, and it arrived. The context is clear and expected. Still, check that the file type matches what was promised: a "PDF guide" should be a PDF, not a ZIP containing a shortcut. Download it promptly, because temporary inboxes delete messages automatically.

An urgent attachment from your "manager" or "CEO"

Messages that impersonate senior staff and demand fast action, payment or secrecy are a known pattern. Verify by phone or in person using a known number. A real manager will not mind.

A reply in an old thread with a new attachment

If the reply is generic, uses a different tone, or contains a file type the person never sends, their mailbox may be compromised. Contact them through a separate channel before opening.

What should I do if I already opened a suspicious attachment?

Mistakes happen to careful people. What matters is acting quickly and calmly. The first minutes are the most important.

1. Stop interacting with the file. Close the document or window. Do not enable anything, do not enter passwords, and do not click further prompts.
2. Disconnect from the network. Turn off Wi-Fi or unplug the network cable. This can stop malware from downloading further components or sending data out.
3. On a work device, report immediately. Call or message your IT or security team from another device. Early reports allow them to contain the issue before it spreads. Do not try to clean a work device yourself.
4. Run a full security scan. Use your installed security software, and consider an offline scan option if your antivirus offers one.
5. Change important passwords from a clean device. Start with your email account, because email is used to reset everything else, then banking and any account you signed into recently on the affected device.
6. Check account activity. Look at recent sign-ins, forwarding rules and connected apps on your email account. Attackers sometimes add a hidden forwarding rule to keep receiving your mail.
7. Turn on or confirm multi-factor authentication for important accounts.
8. If you typed a password into a page opened by the attachment, treat that password as stolen. Change it everywhere you used it.
9. If you entered payment details, contact your bank or card provider using the number on the back of your card.
10. If the device behaves strangely afterward (new programs, disabled security tools, browser redirects), consider restoring from a known-good backup or reinstalling the operating system.

If you only opened an image or a PDF in a fully updated viewer and did not click anything inside it, the realistic risk is low. Running a scan and staying alert is usually enough.

Why attachment safety and inbox privacy belong together

Attachment safety is often presented as a purely technical problem: block the bad file types, scan everything, keep software updated. Those controls matter, but they all act after a dangerous message has already reached you. Inbox privacy works earlier in the chain by limiting who can reach your important inbox in the first place.

Think of it as two layers:

• Exposure layer: how many people and systems know your real address. Every site that has it can leak it, sell it or be breached. Reducing exposure, for example by using a temporary address such as VookMail for one-off sign-ups and downloads, means fewer unknown senders in the future.
• Handling layer: what you do when a file arrives anyway. This is where sender checks, file-type awareness, Protected View, scanning and isolation come in.

Neither layer replaces the other. A private address still receives the occasional phishing attempt, and perfect file handling does not stop your address from spreading. Together they make malicious attachments both rarer and less likely to succeed. To understand what VookMail is designed for and where its limits are, the VookMail FAQ is a good next read.

Frequently asked questions

Can you get a virus just by opening an email?

In modern, updated email clients, simply opening and reading a message is very unlikely to infect a device. The danger usually begins when you open or run an attachment, enable macros or editing, or click a link. Keeping your mail app, browser and operating system updated keeps that risk low.

Are PDF attachments safe?

Most PDFs are harmless, but PDFs can contain links to phishing pages, embedded files and scripts. Opening them in an updated browser or a viewer with JavaScript disabled reduces risk. Be most suspicious of PDFs that ask you to click a button to view a document or sign in.

Is a ZIP file from an unknown sender dangerous?

A ZIP file is only a container, so the risk depends on what is inside. Archives are often used to hide scripts and executables from scanners, and password-protected archives cannot be scanned at all. Do not extract archives from unknown senders unless you have verified the file through another channel.

Does antivirus protect me from all malicious attachments?

No. Antivirus and email filters catch a large share of known threats, but new or customized files can pass through. Treat scanning as one layer and combine it with sender verification, file-type awareness, blocked macros and software updates.

Is it safe to receive attachments in a temporary email inbox?

A temporary inbox such as VookMail receives and stores the file; it does not run it. The safety question is the same as with any inbox: what happens when you download and open the file. Use the temporary inbox to keep your real address private, then apply the same checks before opening anything.

What should I do if I opened a suspicious attachment?

Disconnect the device from the network, do not enter any passwords, run a full scan with your security software, and change passwords for important accounts from a different, clean device. On a work device, report it to your IT or security team immediately so they can contain it.

Should I upload suspicious files to an online virus scanner?

Multi-engine scanners can help with files that contain nothing private. Many of them share uploaded files with researchers, so never upload contracts, invoices, IDs or anything confidential. For those, ask the sender to confirm the file through a separate channel instead.