Opening attachments safely

Module 2: Reading mail · Reading time: 9 minutes

Learning objective: After this lesson you know how an attachment sits inside an email, which types of file are dangerous and why, how to read a file name, and what to do when you are in doubt.

Key concepts: MIME, attachment, base64, file extension, executable file, macro, HTML attachment, double extension, preview in the browser, other channel

How an attachment sits inside an email

Technically, an email is just text. Even so, you can use it to send photos, PDFs and spreadsheets. That works thanks to MIME: an agreement on how to divide an email into parts. An email with an attachment has at least two parts: the text of the message and the file. Each part has its own headers, such as:

Content-Type: application/pdf; name="quote-bridal-bouquet.pdf"
Content-Disposition: attachment; filename="quote-bridal-bouquet.pdf"
Content-Transfer-Encoding: base64

JVBERi0xLjcKJcfsj6IKNSAwIG9iago8PC9MZW5ndGggNiAwIFIvRmlsdGVy
...

The file itself has been converted to text with base64: every 3 bytes become 4 characters. This makes an attachment about a third larger in transit. There is more on this in lesson 3.3. With More > Show source you can see this for yourself in any email with an attachment.

The key insight: the sender chooses the file name and the type of file (Content-Type). Nobody checks along the way whether a file called "invoice.pdf" really is a PDF. The name is a label, not proof.

Why some files are dangerous

A file is dangerous if it can do something on your computer as soon as you open it. A photo or an ordinary PDF shows you something. A program carries out commands. The difference lies in the file extension: the letters after the last dot in the name. Your computer uses it to choose which program opens the file.

Only open these types if you really expect them and have checked the sender through another channel:

Executable files and scripts: .exe, .scr, .bat, .cmd, .js, .vbs, .hta. These are programs or commands. Opening means starting. An ordinary customer, supplier or bank never emails you these.
Shortcuts and disk files: .lnk, .iso, .img. A .lnk can start a command. Windows opens an .iso or .img as an extra drive, and inside there is often another program or shortcut. Attackers use this packaging to get past virus scanners.
Office files with macros: .docm, .xlsm and similar. A macro is a small program inside a document. Office usually blocks macros in files from the internet, but the attack is designed to get you to switch them on anyway. A document that asks you to click "Enable Content" or "Enable Editing" before you can see the text is a warning sign.
HTML attachments: .html or .htm. Your browser opens these as a web page. Often it is a fake login page, for example for your webmail or for Microsoft, with your own address already filled in. Whatever you type goes to the attacker. Because the file is on your own computer, you won't see a suspicious web address in the address bar.
Password-protected zip files where the password is in the email itself. A virus scanner cannot look inside an encrypted archive. That is exactly why attackers do this. An ordinary zip without a password is not necessarily suspicious, but do check what is inside before you open anything.

And PDFs? A PDF is usually safe to view, especially in the browser. The danger lies in what it contains: a "View invoice" button or a QR code that leads to a fake login page. Treat a link in a PDF just as critically as a link in an email (lesson 2.4).

Read the name from right to left

By default, Windows hides the extension of known file types. A file named

quote-bridal-bouquet.pdf.exe

then appears as "quote-bridal-bouquet.pdf". For Windows, only the last extension counts: this is a program. The icon tells you nothing either, because a program can be given any icon, including a PDF icon.

The webmail shows the name as it is in the email, with all extensions. So read it in the webmail before you download anything. If the name is too long and cut off, look at filename in More > Show source. Start on the right: what comes after the last dot? Also watch out for long names with lots of spaces before the real extension, and for names like "Invoice_2026_pdf.zip": they contain "pdf" but are a zip.

Tip for Windows: in File Explorer, switch on file name extensions under View. Then you always see the real extension.

View or download?

If you click the name of an attachment in the webmail, it opens in a new window if your browser can display that type of file, such as a PDF or a photo. That is the safest way to look: the browser shows the file inside its own shielded environment and does not start any program on your computer.

If you download an attachment and open it from your computer, it opens in the program linked to the extension: Word, Excel, or with an .exe, the file itself. That is where the risk lies. So only download what you need and expect.

The image shows a message with two photos attached and the Download all attachments link. That link gives you one zip file with all the attachments. Handy, but it also downloads attachments you haven't viewed.

Trust depends on the situation

An attachment isn't safe or dangerous just because of its file type. The situation matters too. Ask yourself three questions:

Am I expecting this? Emma asked Ahmed for a photo of the dress, so a .jpg from Ahmed makes sense. An unexpected "invoice" from a company she never bought anything from does not.
Does the file fit the story? A quote is a PDF. A quote as .html, .iso or a password-protected zip doesn't fit.
Is the sender right? Look at the address and the domain (lesson 2.2). But be careful: a genuine sender can also be hacked. If Tom's mailbox has been taken over, a dangerous attachment simply comes from tom@example.com, often as a reply in an existing conversation.

If in doubt, ask through another channel: call the sender on a number you already had, or send a new message (not a reply to the suspicious email). A genuine sender won't find that strange.

Did you open something that wasn't right after all? Disconnect the computer from the network, change your passwords from another device and get help. The Safe Online course describes this step by step.

In practice: how it works in the webmail

In the webmail, attachments appear above the text of the message. Click the name to view it; the arrow next to the name lets you choose options such as downloading. Download all attachments gives you one zip file. The Roundcube manual describes the buttons under Opening and saving attachments. Other webmail, such as Gmail or Outlook.com, works in a similar way: there too you can view an attachment in the browser before you download it.

Summary

An attachment is part of the email (MIME), encoded as text with base64; the sender chooses the name and type.
Dangerous files are programs and scripts, shortcuts and disk files, Office files with macros, HTML attachments and password-protected zips.
Read a file name from right to left; only the last extension counts and the icon proves nothing.
Viewing in the browser is safer than downloading and opening.
If in doubt, check through another channel; even a known sender can be hacked.

Quiz

Exercise

Exercise A2.3: Which attachments do you not trust? The material bijlagen-1.txt is below this exercise: ten numbered attachments, each with the sender and the situation in which the email arrived. Assess each attachment using the three questions from this lesson (am I expecting this, does the file fit the story, is the sender right) and what you know about extensions. Enter the numbers of the attachments you would not open. The program compares your selection with the answer key and shows for each attachment whether your choice is correct, with the reason.

Cookies at WebOké

Cookie settings

Necessary

Marketing