How to Receive Files from Strangers Safely

If your work involves receiving files from people you don't fully trust — recruiters opening résumés, journalists reading source documents, designers reviewing client briefs — you live with a chronic low-grade risk. Most files are fine. The one that isn't could compromise your entire machine.

Here's a workflow that lets you accept the file, look at it, and move on, without giving an attacker a foothold.

Step 1 — Never click attachments from unknown senders

Email attachments are the oldest attack vector and they still work. Modern email clients render previews safely, but the moment you save and open a .docx with macros enabled, you're at the attacker's mercy. Don't open. Don't preview. Just close.

If someone needs to send you a file, ask them to use a transfer service like SendMe instead. The link in your inbox is just a URL — clicking it lands you on a normal webpage. You can decide whether to download from there, after you've seen the file metadata (size, content-type).

Step 2 — Inspect the file metadata before downloading

On SendMe's receive page, you see the filename, size, and content-type before downloading. Three red flags to look for: filenames that try to disguise their extension (résumé.pdf.exe), implausibly small sizes for what they claim to be (a 'video' that's 12 KB is a script, not a video), and mismatched content-types (a 'JPG' served as application/javascript).

Step 3 — Download into a dedicated folder

Have one folder — ~/Downloads/from-strangers — that you treat as a quarantine zone. Everything from external sources lands there. Your normal file system never references this folder; nothing else can read from it accidentally.

Step 4 — Scan with multiple engines

Upload the file to virustotal.com. It runs 70+ antivirus engines in parallel. If even one flags it, treat it as suspect. If the file is itself sensitive (say, a leaked document) and you don't want VirusTotal to keep a copy, run your local antivirus first and consider opening it in an isolated environment instead.

Step 5 — Open in an isolated environment

The safest place to open an untrusted file is somewhere it can't hurt your real system. Options, from cheapest to most robust:

• →Google Docs preview — fine for documents, no macros executed.
• →macOS Quick Look — read-only preview, sandboxed.
• →A disposable virtual machine (use VirtualBox + a Linux snapshot you can roll back).
• →Qubes OS — an entire operating system designed for compartmentalisation.
• →Tails OS booted from a USB — leaves no trace on shutdown.

For most people, Google Docs preview or macOS Quick Look is enough. Anyone receiving files from genuinely hostile actors should invest in the VM workflow.

Step 6 — Disable macros, JavaScript, and links

If you must open a Word document, turn off macros globally (File → Options → Trust Center → Macro Settings → Disable all macros without notification). PDFs can contain JavaScript — disable it in Adobe Reader (Preferences → JavaScript). Links inside documents can phish you — never click links inside a document from an untrusted source; type the URL yourself if you must visit.

Step 7 — Delete after use

Once you've extracted whatever value the file offered, delete it. On macOS, empty the Trash with `srm -rf` if it's sensitive. On Windows, use SDelete from Sysinternals. The fewer copies of an untrusted file you keep around, the smaller the attack surface.

What if the file is from a known sender but feels off?

Treat 'known sender, suspicious content' as 'unknown sender'. Accounts get compromised. A colleague's email asking you to 'click here for the brief' might genuinely be from them — or might be from someone who's just got their password. Verify out-of-band: send them a Slack message, call them, anything other than replying to the suspect email.

The 80/20 rule

If you remember nothing else: (1) never enable macros, (2) never run executables from strangers, (3) preview documents in browser-based viewers before downloading locally. That covers 95% of file-borne attacks. The remaining 5% is the difference between 'cautious internet user' and 'professional opsec', and most people don't need to operate at the latter level.