Only open attachments from the vetted and trustworthy source. When unsure, talk to the alleged sender directly. In the event the sender is non-responsive or vague in regards to the context, it would be most effective to suppose it had been a phishing endeavor and report it on to the IT and/or the sa