How to never open unexpected email attachments or links

Reading is great. Tracking makes it stick. Sign up for a free Dashboard to tick off tasks and see your Security Score.

Get my free Dashboard →

Cyber Nova AI helps you prepare for Cyber Essentials. It doesn't award or certify it. Follow the steps here to get ready, then apply for certification through an accredited Cyber Essentials body when you're set.

MalwareHigh priority

About 2 minutes to complete

Treat any unexpected file attachment or link, even from someone you know, with suspicion before you click.

Step-by-step guide

Before opening an attachment or clicking a link:
Were you expecting this email?
Does the sender's address look genuine (not spoofed)?
Hover over the link. Does the URL match what is displayed?
If in doubt, contact the sender by phone to verify
Report suspicious emails to your email provider or IT team

6 steps

Why this matters

The majority of ransomware and malware infections begin with a phishing email. Pausing before clicking is free and highly effective.

How to confirm it worked

The setting is saved and active on your device
You have tested it works before closing the page

Tick this task off in your Dashboard to update your Security Score.

Frequently asked questions

How do I tell if an email link is genuine?

Hover your mouse over the link: the actual web address it points to appears at the bottom of your screen. Check that the domain matches the organisation it claims to be from. For example, a genuine Amazon link will go to amazon.co.uk, not amazon-security-notice.net. On a phone, press and hold the link to preview the URL before tapping it.

Can an email be dangerous even if I do not open any attachments?

Opening the email itself is usually safe in modern email apps. The risk comes from clicking links or downloading attachments. Some highly targeted attacks use tracking pixels embedded in emails, but this risk is low for most people.

What should I do if I accidentally clicked a phishing link?

Do not enter any information on the page that opens. Close the tab immediately and run a quick virus scan. If you did enter a password, change it immediately on the legitimate website, then add two-factor authentication. If it was a banking link, call your bank directly.

Where can I report phishing emails in the UK?

Forward suspicious emails to report@phishing.gov.uk (the NCSC's free reporting service). Your email provider also has a "Report phishing" option (in Gmail, click the three-dot menu on the email). Reporting helps get phishing sites taken down faster.

Want a device-specific walkthrough?

Android: How to spot phishing on Android →
Windows: How to spot phishing on Windows →

Related security tasks

Track your security score for free

Create a free Cyber Nova AI account to tick off tasks like this one, see your Security Score, and stay on top of what you've done and what's still to do.

Start your free security check