PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
you opened a suspicious email attachment and fear it installed malware

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Stop using the device for passwords, payments or other sensitive activity until it has been checked. Contact your organisation’s IT team immediately for a work or school device; on a personal PC or laptop, use the antivirus already installed to run a full scan and follow its recommendations.

Do not do these things

  • Do not reopen the attachment, click other links in the email, reply to the sender or accept further prompts.
  • Do not log into banking, email, work or other important accounts on the device while it may be infected.
  • Do not install security or cleanup software suggested by a pop-up, unexpected caller, email or unfamiliar website.
  • Do not pay a caller, pop-up or message claiming that payment will remove malware or unlock the device.
  • Do not wipe, factory-reset or reinstall the device in a rush, because this can erase data and complicate recovery.
  • Do not delete a work or school email before the IT team tells you whether they need it.

What to do now

  1. Close the attachment and the email. Note the sender, subject line, attachment filename, approximate time you opened it and any prompts, permissions or installation steps you accepted.
  2. If this is a work or school device or account, contact the organisation’s IT or security team now. Follow their instructions before deleting the email, restarting the device, running tools or making other changes.
  3. If a personal PC or laptop is behaving strangely, showing unfamiliar pop-ups, restarting by itself, opening programs unexpectedly or displaying an infection warning, disconnect its Wi-Fi or network cable and stop using it for sensitive tasks.
  4. On a personal PC or laptop that is stable, install available official updates for the device and programs. Open the antivirus software already installed or built into the operating system, run a full scan and allow it to quarantine or remove anything it finds.
  5. If the antivirus cannot run or clean the device, or the unusual behaviour continues, stop using it for important accounts. Seek support through the device manufacturer’s official support route or a reputable computer technician.
  6. From another device you trust, change the password for any account you logged into after opening the attachment. Also change it on other accounts where you used the same password.
  7. If you entered banking or payment information, or money has moved unexpectedly, contact your bank immediately using the number on your card, statement or official website. Report hacking or financial loss to Report Fraud in England, Wales or Northern Ireland, or to Police Scotland in Scotland.
  8. Forward the suspicious email to [email protected] without reopening the attachment. For a work or school email, use your organisation’s reporting process instead if instructed.

What can wait

Identifying the exact malware, choosing new security software, replacing the device, restoring backups, factory-resetting it and investigating who sent the attachment can wait until the scan or IT assessment is complete. You do not need to make every recovery or reporting decision now.

Important reassurance

Opening a suspicious attachment does not prove that malware was installed. Promptly checking the device, avoiding sensitive activity and not making rushed irreversible changes can limit the harm if there is a problem.

Scope note

This guide covers immediate first steps after opening a suspicious email attachment. Removing a confirmed infection, reinstalling a device, restoring backups and recovering compromised accounts may require specialist help.

Important note

This is general cyber-security information, not personalised technical, legal, financial or other professional advice. Follow instructions from your organisation’s IT team, your bank, the device manufacturer or an appropriately qualified professional where relevant.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us