A warning that Gmail cannot scan an attachment does not mean the file has been proved malicious, but it also does not mean the file is safe. Treat the missing scan result as information you need to account for before opening it.
Understand what can prevent a reliable check
Google lists encrypted attachments, such as password-protected documents, among situations where virus scanning cannot inspect the contents. It also warns about attachments that can contain unverified scripts.
For client-side encrypted mail, Google’s documentation separately explains that encrypted attachments cannot be scanned for viruses. That is a feature-specific limitation, not a general assurance about whatever is inside the encrypted message.
Verify the expected file and sender independently
Ask whether you were expecting this exact document, what it should contain, and whether the sender’s established contact can confirm it. Use a known channel rather than the telephone number or link supplied only in a suspicious message.
A familiar display name, company logo, or password sent in the same email is not sufficient authentication. If the request is unexpected, urgent, or asks you to run software, stop and involve the organization’s security contact.
Keep endpoint protection enabled. Where the organization provides a safe inspection process, use that process rather than uploading private files to an unapproved public scanning website. Do not enable document macros or active content merely to dismiss the warning.
Distinguish attached email from authenticated evidence
Google says it checks attached EML messages for spam and viruses but cannot confirm that the purported senders actually sent the emails inside them. An attached message is therefore not independent proof that its visible sender authorized an instruction.
If you cannot establish a safe reason to open the attachment, ask the real sender for an approved alternative or report the suspicious email. Deleting a dubious local copy is different from proving the account has been compromised; avoid making that broader conclusion from the scan warning alone. Keep the message or evidence according to your organization’s incident-handling rules.
Browse Gmail & Google Account help
References
- Open & download attachments in Gmail
- File types blocked in Gmail
- Learn about Gmail Client-side encryption
Reviewed against the linked official and developer guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.