Legitimate businesses and friends will almost always give you a heads-up or include a personalized message. If the only thing identifying a file is a random code like , it is best to assume it’s a threat and hit the delete button.

Even "previewing" certain files in a browser can occasionally exploit vulnerabilities.

The link may take you to a fake login page (looking like Google Drive or Microsoft 365) to "verify your identity" before downloading.

Below is a blog-style guide on how to handle these mysterious download prompts and why you should exercise extreme caution.