Only open attachments from the vetted and trusted resource. When doubtful, communicate with the alleged sender directly. When the sender is non-responsive or obscure in regards to the context, it might be best to presume it was a phishing endeavor and report it on to the IT and/or the security te