The Email Attachment Bomb
Flggd Scam School · Tech Support & Device Takeover · Lesson 10 of 12
An invoice you don't remember, a receipt for something you didn't buy, a "shared document" from a name you barely know. An unexpected email attachment is one of the oldest tricks online because it still works.
The message looks like this
Why this is a scam
The attachment is the payload. Zip files, documents that ask you to "enable macros", and files with doubled endings like invoice.pdf.exe are all wrappers for malware. One open can install software that logs your typing or locks your files.
The story around it is chosen to make you click fast. A charge you didn't make triggers alarm; the "dispute instructions" are inside the attachment, so worried people open it. Curiosity and fear both point at the same file.
Real companies put invoice details in the email body or behind a login on their own website. And a real wrong charge is disputed at your bank, never through a mystery attachment.
Red flags checklist
An attachment you weren't expecting, from anyone, on any subject.
Zip attachments, or documents that ask you to "enable content" or "enable macros".
A charge story designed to alarm you into opening the proof.
A sender address that doesn't match the company name in the message.
Generic greetings: "Dear Customer" on a supposedly personal invoice.
The manipulation tactic
Alarm plus curiosity. The email creates a question only the attachment can answer, and opening it feels like the careful thing to do.
What to do, and what not to do
Don't open attachments you weren't expecting; not even to check.
Verify charges in the one place that's real: your card or bank statement.
If it claims to be from a company, go to that company's site yourself.
If you opened one: disconnect from the internet, run a full antivirus scan, and change your main passwords from another device.
Delete the email. Mark it as spam so its siblings get caught too.
Not sure about a message you've received? Check it in seconds with the free Flggd app.
