A document that asks you to enable content or macros is the warning sign itself. Delete it, set Office to keep macros switched off, and tell staff that deleting such files is always safe.

An attachment that will not open properly

The email looks routine: an invoice, a remittance advice, a purchase order, a scanned fax. The attachment is a Word or Excel file.

It opens to a page of garbled characters, or nothing at all. Across the top, a line of text explains that the document is protected and asks you to enable content to view it.

Word may also show its own yellow bar, saying macros have been disabled, with a button to turn them on.

That button is the attack. Everything before it was harmless.

What a macro does here

A macro is a small program stored inside a document. Offices use them legitimately, in quoting spreadsheets and letter templates.

Because they are programs, Office has not run macros in outside documents automatically for years. It switches them off and asks first.

The people sending these files cannot get past that setting, so they ask the reader to switch it off for them. The garbled text is deliberate: it gives you a reason to click.

Once enabled, the macro quietly downloads a program from a website and starts it. Nothing visible happens in the document.

The signs, in the order you meet them

The fourth settles it. No genuine invoice needs a program to run before you can read it, and no supplier will ask you to change a security setting to see what you owe.

What the download does

Two kinds of program are common this winter. Ransomware encrypts documents on the computer and on every shared drive it can reach, then demands payment for the key.

Banking malware hides and waits for someone to log in to online banking, then steals the login or interferes with payments.

Antivirus software catches many of these, but new versions appear constantly and can go unrecognised for a day or two. The click is the last point where a person can stop it.

The Office setting that keeps macros off

Word and Excel each have a Trust Center, under File, then Options. Its macro settings offer four choices, and the default is to disable macros with a notification, which is the yellow bar.

Choosing to disable all macros without notification removes the bar. Macros in outside documents simply do not run, and there is nothing to click.

Keep Protected View switched on as well. In Office 2010 and 2013, it opens email attachments in a read-only mode by default, and it should stay that way.

The setting is per program and per computer. In an office with a Windows server, it can be set once for everyone through group policy.

When the office relies on macros

Some offices have one spreadsheet that needs its macros: a quoting tool, a price calculator, an old order form.

That does not require macros to be on for every file. The Trust Center lets you mark a folder as a trusted location; documents in it run their macros, and everything else stays off.

Put the office's own files there, and nothing that arrived by email.

Tell staff they can delete it

The person who opens the attachment is usually conscientious. They are worried about an unpaid invoice, a missed order or a document the boss is waiting for.

Tell them, in writing, that deleting a document like this is always the right call and nobody will be blamed. A real supplier will send it again or phone.

If they want to check, they should call the sender on a number from your own records, not one from the email.

A worked example

A martial arts supply store sells uniforms, belts, sparring gear and training weapons from a unit in a strip mall, and ships orders to dojos and clubs from its back room.

In December the assistant who handles the accounts received an invoice that seemed to come from the company that makes the store's uniforms.

The Word file showed garbled text and a note asking her to enable content. She did, and nothing happened.

The next morning, the order records, club accounts and price lists on the shared drive had been renamed and would not open, and a demand for payment sat in every folder.

The company that looks after the store's computers restored the shared drive from the previous night's backup, losing a day's orders, and rebuilt her computer.

Macros were then set to stay off without notification on all three computers, with one trusted folder for the store's own price calculator.

The email filter now holds Word and Excel attachments containing macros, and a one-line rule is taped beside each screen: if a document asks to enable anything, delete it.

A backup the ransomware cannot reach

A backup drive that stays plugged in is just another drive to encrypt. Ransomware does not distinguish between the shared folder and its copy.

Keep at least one copy disconnected or off site, rotate it, and test a restore now and then. That copy is why the example above cost a day and not the files.

Stopping it before it arrives

Many email filters can hold or strip attachments by type, and some can spot documents that contain macros. Ask whoever runs your email what is possible, since a file nobody receives cannot be opened.

Keep Office and Windows updated as well. Some documents attack flaws in the software itself rather than asking for help, and updates close those.

The counter-case

An office that exchanges macro spreadsheets with a trusted partner every week cannot block every one at the filter. The answer there is a trusted location, agreed file names and a phone call when anything looks different.

And no setting replaces judgement. A determined sender will try PDFs, links and fake login pages next.

But most small offices never need macros from outside. Keep them switched off, and make deleting such a document the expected thing to do.

This week

  1. Set Word to disable macros without notification.
  2. Do the same in Excel on every computer.
  3. Leave Protected View switched on for attachments.
  4. Tell staff in writing that deleting is always safe.
  5. Check doubtful invoices by phone, using your own records.
  6. Keep one backup disconnected from the network.
  7. Ask your email provider about filtering macro attachments.

Step four is the one settings cannot do. A member of staff who believes a deleted invoice will get them in trouble will keep looking for a way to open it.

A different email that relies on urgency to get a quick reply is covered in the urgent email about your name in foreign domains.

Frequently asked questions

Why does the document look garbled?

Deliberately. The scrambled text gives you a reason to enable content, which switches on the macro that downloads the real program. A genuine document reads normally when opened.

What happens if someone clicks enable content?

The macro downloads a program from a website and runs it. Common ones encrypt files on the computer and shared drives, or steal online banking logins.

Which Office setting stops this?

In each program's Trust Center, choose to disable all macros without notification, and leave Protected View on. Macros in documents from outside then never run.

What if our office uses macro spreadsheets?

Put those files in a folder marked as a trusted location. They keep working, and every other document, including email attachments, stays blocked.

Is it safe to delete a real invoice?

Yes. A genuine supplier will send it again or phone. If in doubt, ring them using a number already in your files, never one from the email.

Will antivirus software catch these files?

Often, but not always. New versions appear constantly and can go unrecognised for a day or two, so the setting and staff habits matter as much.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Staff unsure which attachments to delete?

Tell us how many computers you have. We will set macros off on each one and write the rule for staff.

Start a Conversation