Is it safe to receive files? A checklist before you open anything

Yes, receiving files is generally safe, provided you treat opening them as a separate decision. A downloaded file sitting in a folder does nothing. Harm comes from running a program disguised as something else, enabling macros in an Office document, or typing your password into a fake "download your files" page. The checklist below works for email attachments, chat apps, cloud links and live peer-to-peer tools alike, because the transfer method does not change what is inside the file.

The 60-second checklist

1. Were you expecting it? An unexpected file, even from someone you know, is the most common starting point for an attack. Accounts get hijacked.
2. Can you see the real extension? Turn on file extensions (instructions below) and read the very end of the name.
3. Is the type on the high-risk list? Executables, scripts, shortcuts and disk images need a very good reason to exist in a delivery.
4. Does it ask you to lower a defence? "Enable content", "enable editing to view", "install this player" and "disable your antivirus" are red flags on their own.
5. Has it been scanned? Use the antivirus already on your device before opening.
6. If anything feels off, confirm with the sender another way. Call or message them on a channel you already use, not by replying to the message that delivered the file.

Which file types deserve suspicion

Risk depends on what the file can do when opened. A photo is data that a viewer displays. An executable is instructions your computer carries out with your permissions.

For a typical delivery from a photographer, designer or colleague, you should expect images, video, PDFs, Office files without "m" in the extension, or a ZIP containing those. A program, script or shortcut in that context is a strong signal to stop.

The disguise tricks to know

Hidden and double extensions

Windows hides known file extensions by default, so invoice.pdf.exe displays as invoice.pdf, often with a convincing icon. Fix this once: in File Explorer, select View > Show > File name extensions, which is Microsoft's own instruction. On a Mac, open Finder, choose Finder > Settings > Advanced and tick Show all filename extensions. Then read the last extension in the name; that is the only one that counts.

Also be wary of very long file names padded with spaces before the real extension, and of names whose characters look reversed, which can indicate a Unicode right-to-left override trick that flips how the end of the name is displayed.

Disk images and shortcuts

Windows adds a "Mark of the Web" to files downloaded from the internet, and security features such as SmartScreen and Office's macro blocking rely on that mark. Attackers learned that wrapping files in a disk image could shed it. In 2022, ISO attachments containing a .lnk shortcut were used in phishing campaigns precisely because Windows failed to pass the mark to the files inside. Microsoft fixed that specific flaw (CVE-2022-41091) in its November 2022 updates, but the lesson stands: a disk image or archive that contains a shortcut or script, rather than the documents you expected, is suspicious, and keeping Windows updated matters.

Office macros

Microsoft now blocks VBA macros by default in Office files that carry the Mark of the Web, on Windows, from Version 2206 of Current Channel onward. Instead of the old "Enable content" button, you see a red "Security risk" banner saying macros have been blocked. Microsoft introduced the change because, in its words, VBA macros are a common way for attackers to deliver malware and ransomware. If a document tells you to unblock it in Properties, move it to a different folder or save it elsewhere to "see the content properly", treat that as an attack.

Scanning files before you open them

Use what is already on your device

On Windows 11, right-click the file, choose Show more options, then Scan with Microsoft Defender, as described on Microsoft's support site. Windows Security also scans downloads automatically in real time while it is your active antivirus. On a Mac, Gatekeeper and XProtect check apps when you first open them; a warning that an app "cannot be verified" or "will damage your computer" should be taken at face value, not clicked through.

A clean scan lowers risk but does not prove safety. New malware is sometimes missed for hours or days, which is why the checklist puts "were you expecting it?" first.

The VirusTotal privacy caveat

VirusTotal checks a file against dozens of antivirus engines and is a genuinely useful second opinion. But understand what an upload means. VirusTotal's own documentation says basic results are shared with its examining partners, scan reports are shared with the public VirusTotal community, and the contents of submitted files may be shared with premium VirusTotal customers. Those customers are mostly security companies and researchers, which is the point of the service, but it means you should never upload a contract, a client's photos, medical records or anything else confidential.

Fake "you've received files" emails

File-transfer notifications are a favourite disguise for phishing because they are expected, routine and come from services everyone recognises. The typical message says files are waiting or about to expire, and the button leads to a fake login page for Microsoft 365, Google or a transfer service. The goal is your password, not to deliver a file.

CISA's phishing guidance lists the signals to watch for: urgent or emotional language, requests for personal or financial information, and links whose addresses are slightly wrong. It also warns that AI tools mean scam emails can now have perfect spelling and grammar, so polished writing is no longer reassurance. The UK's NCSC adds the classic pressure tactics of authority, urgency, emotion and scarcity, and asks a simple question: were you expecting this message?

Specific checks for transfer notifications:

• Hover before you click. WeTransfer's help centre, for example, tells users that genuine download links point to wetransfer.com or we.tl, and that a link anywhere else should not be clicked. Other services have equivalent official domains.
• Downloading a file should not need your email password. Being asked to "sign in with your Microsoft account to view" a transfer from a service you have no account with is the most common credential-harvesting pattern.
• Look at the sender's real address, not just the display name.
• Watch for detours. A link that sends you through a document-viewer or "secure portal" page before the download is a warning sign.
• Peer-to-peer tools rarely email you at all. Live browser-to-browser services such as ours work by the sender giving you a link or code directly, so an unsolicited email claiming files are waiting for you from such a service deserves extra suspicion.

Verify the sender out of band

"Out of band" means using a different channel from the one that delivered the file. If an email from a colleague contains an unexpected ZIP, message them on Teams or call them. If a client's WhatsApp asks you to open an invoice, phone the number you already have on file. The NCSC's advice is to contact the organisation directly using details from its official website or your existing records, never the contact details in the suspicious message itself.

This step costs a minute and defeats the most dangerous scenario: a real contact whose account has been taken over, sending a real-looking file through a real service.

Phones and tablets

iPhones and most Android phones will not run desktop malware such as .exe files, and apps can only be installed through controlled routes. Phone risks are different: an Android APK file from outside the Play Store, a configuration profile on an iPhone, or a link to a fake login page. Never install an APK or a profile because a file transfer told you to. On iPhone, received files land in the Files app; on Android they usually go to Downloads, where you can inspect the name and type before opening anything.

If you opened something you should not have

1. Disconnect from Wi-Fi or unplug the network cable.
2. Run a full scan with your security software.
3. If you entered a password anywhere, change it from a different, clean device and turn on two-step verification.
4. At work or school, report it to IT immediately. Early reports limit damage.
5. Report the phishing message: in the UK through the NCSC's reporting service, in the US through your email provider's "report phishing" option or CISA's reporting channels.

Choosing a transfer service still matters for privacy in transit; encrypted options such as the live peer-to-peer transfers we offer protect the file from eavesdroppers. But no transfer service can make a malicious file safe. That part is the checklist's job. If you send work to others, our guide on delivering large files to clients covers how to make your own deliveries easy to trust.

Sources

• CISA: Recognize and Report Phishing
• NCSC: Spotting scam messages
• NCSC: Report a scam email
• Microsoft Learn: Macros from the internet are blocked by default in Office
• Microsoft Support: Common file name extensions in Windows
• Apple Support: Show or hide filename extensions on Mac
• Microsoft Support: Stay protected with Windows Security
• BleepingComputer: Microsoft fixes MotW zero-day used to drop malware via ISO files
• VirusTotal: How it works
• WeTransfer Help Center: Phishing attempts and other WeTransfer imitations