Why attachments and links are the usual route in
Plain text in an email cannot do much harm by itself. Trouble tends to come from what the message asks you to do next: open a file or follow a link. Both actions move you out of the controlled setting of your inbox and into something the sender created.
An attachment is a file that runs, or is opened by, a program on your device. A link takes your browser to a page someone else controls. Either can be harmless or malicious, and from the inbox alone the two can look identical. That is why attackers favour them, and why a short routine of checking is worth building.
What can go wrong with an attachment
Some attachments contain software that installs itself when you run it. Others are ordinary-looking documents, such as word-processor files, spreadsheets or PDF files, that carry embedded instructions or prompt you to enable editing or macros so that something runs. Others hold a link or a scanned image of a fake invoice pointing you toward a payment or a login page.
Typical aims are to steal passwords, lock files and demand payment, or gain a foothold on a device. Most major email providers scan attachments and block known threats, but scanners cannot catch everything, particularly new or tailored attacks. Treat the filter as a safety net rather than a guarantee.
What can go wrong with a link
Links usually cause harm in one of two ways. The first is a fake sign-in page: it imitates a bank, email provider or delivery company and collects whatever you type. The second is a page that tries to install something or trick you into approving a download or permission. The text you see in an email can say one thing while the underlying address goes elsewhere, which is why looking only at the visible words is not enough.
Attackers also rely on web addresses that look right at a glance. Swapping a letter for a similar one, adding extra words, or using a different ending can produce lookalike domains that pass a quick look. Reading the part just before the first single slash is usually the most revealing part of an address.
Checking the sender first
Before any file or link, ask whether the message makes sense.
- Were you expecting it? An unrequested invoice, voicemail, shared document or parcel notice deserves more suspicion than a reply in a thread you started.
- Does the address match the claim? The display name is easy to fake. Look at the full address behind it. Do not rely on a familiar name alone.
- Is it pushing urgency? Threats of account closure, deadlines of a few hours and requests for secrecy are common pressure tactics.
- Is the greeting or wording off? Generic greetings and odd phrasing are hints, though polished messages exist, so a clean message is not proof of safety.
Many of these signs are described in more detail in the material on phishing emails. A message from a real contact can also be a problem if their account has been taken over, so an unusual request from a known person deserves a second check too.
How to inspect a link without clicking
On a computer, hover the pointer over a link and the destination usually appears at the bottom of the browser or mail window. On a phone, pressing and holding a link usually shows a preview of the address instead of opening it. Check these points:
- Does the domain match the organisation named in the message?
- Is the address unusually long, or full of random characters?
- Does the address begin with a familiar brand name that is actually just a prefix on an unrelated domain?
- Is it a shortened link? These hide the destination, so be wary when you cannot tell where one leads.
When in doubt, do not use the link at all. Open your browser, type the organisation’s known address yourself, or use its official app, then look for the notification there. This sidesteps the question entirely.
How to inspect an attachment
Check the file name and type. File extensions reveal what a file really is, and some types, such as programs and scripts, are rarely something you should receive unexpectedly. Be careful with files that have two extensions, like “invoice.pdf.exe”, because some systems hide the final part by default. Compressed archives, which come from file compression, can hide their contents until opened, so an unexpected zip file from a stranger is a reason for caution.
Other sensible steps:
- Ask the sender, using a different channel such as a phone call to a number you already have, whether they sent it.
- Preview the file in your email provider’s viewer or in a cloud storage service’s preview instead of downloading it to your device, which keeps it away from your local programs.
- Keep your device’s software updates current, since updates often fix weaknesses these files try to exploit.
- Be suspicious of any document that asks you to enable macros or editing to see the content.
If you already clicked or opened something
Do not panic, and do not assume the worst. Steps that typically help:
- Disconnect from the internet if you opened an unknown file and the device behaves oddly.
- If you entered a password on a page that looks suspect, change it right away on the real site, and on any other site where you reused it. A password manager makes unique passwords much easier to maintain.
- Turn on or check two-factor authentication for important accounts, so a stolen password alone is not enough.
- Run a scan with your device’s built-in or trusted security software.
- If money or banking details were involved, contact the institution using a number from its official site or card.
Reporting the message to your email provider also helps its filters. Wider recovery guidance exists in the material on scam recovery steps.
Building a small habit
No single check is perfect, so the idea is to stack a few cheap ones: pause, ask whether you expected the message, look at the real address, and verify by another route when anything feels off. That small pause costs seconds, and it removes most of the leverage that attackers rely on.