Do not open an unexpected attachment until you have verified both the sender and the reason for the file. A familiar extension is not a guarantee. Never enable macros or install software just because a document tells you to.
Expected matters more than familiar
A known person's mailbox can be compromised. Ask whether the file fits your conversation, using a contact method you already have. A name like ‘invoice.pdf’ can be misleading, especially when file extensions are hidden. Check the file details without running it.
Three prompts that should make you stop
- ‘Enable content or macros’: do not disable protections for an unverified document.
- ‘Install a viewer’: do not download software from the email.
- ‘Sign in to read’: an attachment can lead to a fake account page; open the service yourself.
Archives and PDFs are not automatically safe
A ZIP file is packaging, not a safety mark. A password supplied in the email says nothing about the content. PDFs can contain links to malicious sites. Keep your software updated and avoid uploading confidential files to public scanning services. On a work device, contact IT; if you already ran a file, tell them what happened rather than reopening it to check.
Check why you received a document before opening it, and keep protective settings enabled.
Sources and further help
The linked information supports this guide. It does not imply that these organisations work with or endorse MailMigo.