Module 2 · 2.3

English

Nederlands English Deutsch Français Español

Opening attachments safely

Module 2: Reading email · Reading time: 9 minutes

Learning objective: After this lesson you know how an attachment sits inside an email, which kinds of files are dangerous and why, how to read a file name, and what to do when you are in doubt.

Key concepts: MIME, attachment, base64, file extension, executable file, macro, HTML attachment, double extension, preview in the browser, another channel

How an attachment sits inside an email

Technically, an email is just text. Even so, you can use it to send photos, PDFs and spreadsheets. That is possible thanks to MIME: an agreed way of splitting an email into parts. An email with an attachment has at least two parts: the text of the message and the file. Each part has its own headers, such as:

Content-Type: application/pdf; name="offerte-bruidsboeket.pdf"
Content-Disposition: attachment; filename="offerte-bruidsboeket.pdf"
Content-Transfer-Encoding: base64

JVBERi0xLjcKJcfsj6IKNSAwIG9iago8PC9MZW5ndGggNiAwIFIvRmlsdGVy
...

The file itself has been converted to text with base64: every 3 bytes become 4 characters. That makes an attachment roughly a third larger on its way. There is more about this in lesson 3.3. With More > Show source you can see this for yourself in any email with an attachment.

The key insight: the sender chooses the file name and the file type (Content-Type). Nobody checks along the way whether a file called "factuur.pdf" (invoice.pdf) really is a PDF. The name is a label, not proof.

Why some files are dangerous

A file is dangerous if it can do something on your computer as soon as you open it. A photo or an ordinary PDF shows you something. A program carries out commands. The difference lies in the file extension: the letters after the last dot in the name. Your computer uses it to decide which program opens the file.

Only open these kinds of files if you really expect them and have checked the sender through another channel:

Executable files and scripts: .exe, .scr, .bat, .cmd, .js, .vbs, .hta. These are programs or commands. Opening them means running them. An ordinary customer, supplier or bank never sends you these by email.
Shortcuts and disk image files: .lnk, .iso, .img. A .lnk can start a command. Windows opens an .iso or .img as an extra drive, and inside there is often another program or shortcut. Attackers use this packaging to get past virus scanners.
Office files with macros: .docm, .xlsm and similar. A macro is a small program inside a document. Office usually blocks macros in files from the internet, but the attack is designed to get you to switch them on anyway. A document that asks you to click "Enable Content" or "Enable Editing" before you can see the text is a red flag.
HTML attachments: .html or .htm. Your browser opens these as a web page. Often it is a fake login page, for example for your webmail or for Microsoft, with your own address already filled in. Whatever you type goes to the attacker. Because the file is on your own computer, you won't see a suspicious web address in the address bar.
Password-protected zip files where the password is in the email itself. A virus scanner cannot look inside an encrypted archive. That is exactly why attackers do this. An ordinary zip without a password is not necessarily suspicious, but do check what is inside before you open anything.

And PDFs? A PDF is usually safe to view, especially in the browser. The danger lies in what it contains: a "View invoice" button or a QR code that leads to a fake login page. Treat a link in a PDF just as critically as a link in an email (lesson 2.4).

Read the name from right to left

By default, Windows hides the extension of known file types. A file named

offerte-bruidsboeket.pdf.exe

then appears as "offerte-bruidsboeket.pdf". For Windows, only the last extension counts: this is a program. The icon tells you nothing either, because a program can be given any icon, including that of a PDF.

The webmail shows the name as it appears in the email, with all its extensions. So read it in the webmail before you download anything. If the name is too long and cut off, look at filename under More > Show source. Start on the right: what comes after the last dot? Also watch out for long names with lots of spaces before the real extension, and for names like "Factuur_2026_pdf.zip": they contain "pdf" but are a zip.

Tip for Windows: in File Explorer, switch on file name extensions under View. Then you will always see the real extension.

View or download?

If you click the name of an attachment in the webmail, the webmail opens it in a new window if your browser can display that kind of file, such as a PDF or a photo. That is the safest way to look: the browser shows the file within its own protected environment and doesn't start any program on your computer.

If you download an attachment and open it from your computer, it opens in the program linked to the extension: Word, Excel or, for an .exe, the file itself. That is where the risk lies. So only download what you need and expect.

The image shows a message with two photos attached and the Download all attachments link. That link gives you one zip file containing all the attachments. Handy, but it also downloads attachments you haven't looked at.

Trust depends on the situation

Whether an attachment is safe or dangerous doesn't depend only on the type of file. The situation matters too. Ask yourself three questions:

Am I expecting this? Sanne asked Ahmed for a photo of the dress, so a .jpg from Ahmed makes sense. An unexpected "invoice" from a company she never bought anything from does not.
Does the file fit the story? A quote is a PDF. A quote as .html, .iso or a password-protected zip doesn't fit.
Is the sender right? Look at the address and the domain (lesson 2.2). But be careful: a genuine sender can also have been hacked. If Daan's mailbox has been taken over, a dangerous attachment simply comes from daan@example.com, often as a reply in an existing conversation.

If in doubt, ask through another channel: call the sender on a number you already had, or send a new message (not a reply to the suspicious email). A genuine sender won't find that strange.

Did you open something that wasn't right after all? Disconnect the computer from the network, change your passwords from a different device and get help. The Safe online course describes this step by step.

In practice: how it works in the webmail

In the webmail, attachments appear above the text of the message. Click the name to view it; the arrow next to the name gives you options such as downloading. Download all attachments gives you one zip file. The Roundcube manual describes the buttons under Opening and saving attachments. Other webmail, such as Gmail or Outlook.com, works in a similar way: there too you can view an attachment in the browser first before you download it.

Summary

An attachment is part of the email (MIME), encoded as text with base64; the sender chooses the name and type.
Dangerous ones are programs and scripts, shortcuts and disk image files, Office files with macros, HTML attachments and password-protected zips.
Read a file name from right to left; only the last extension counts and the icon proves nothing.
Viewing in the browser is safer than downloading and opening.
If in doubt, check through another channel; a known sender can also have been hacked.

Quiz

Exercise

Exercise A2.3: Which attachments do you not trust? The material bijlagen-1.txt is below this exercise: ten numbered attachments, each with the sender and the situation in which the email arrived. Assess each attachment using the three questions from this lesson (am I expecting this, does the file fit the story, is the sender right) and what you know about extensions. Enter the numbers of the attachments you would not open. The program compares your selection with the answer key and shows for each attachment whether your choice is right, with the reason.

Cookies at WebOké

Cookie settings

Necessary

Marketing