What the attachment labels and warnings mean

Every file a customer or vendor sends is checked twice before you can open it: once for malware (viruses and other harmful programs) and once for phishing (files built to trick you into typing a password or paying a fake invoice).

Each attachment shows its file type next to the name, for example PDF, XLSX, EML or HTML. Long names are shortened in the middle, so the type at the end always shows. Hover over a file to see its full name and what the checks found.

• Grey label, green shield: an ordinary file type and no malware found.
• Amber label and shield: a file type that is often used in attacks: an email attached inside an email (EML/MSG), a web page (HTML/SVG), a program or script, or an archive (ZIP/RAR). It may be fine, but only open it if you were expecting it.
• Red "Likely phishing": the file does what phishing files do, such as sending your browser to another website as soon as it opens, asking for a password, pretending to be Microsoft or DocuSign, or claiming to be a PDF when it is really a web page. A red box above the files explains what was found. Click Why it was flagged for the full list.
• Quarantined: malware was found. The file can't be downloaded.
• Scanning…: the checks are still running. This usually takes a few seconds.

If a file is flagged:

1. Don't open it, and never enter a password on a page it opens.
2. Call the sender on a number you already have (not one from the email) and ask whether they sent it. Their mailbox may have been hacked, so a green Authenticated badge on the message doesn't mean the file is safe.
3. If someone already opened it and typed a password, change that password straight away and tell your administrator.

A green shield means no malware was found. It is not a promise that the file is safe: phishing files often contain no malware at all.