An attachment arrives with a familiar company name and a message saying that macros must be enabled to view an invoice. The request may sound like a routine compatibility step. It is also a reason to stop: a document asking to run code needs a different level of trust from a page you simply read.
Microsoft’s documentation on internet macros explains how supported Office applications on Windows block macros in files marked as coming from the internet. Behaviour depends on application version, policies and trust settings. A missing warning is not proof that an attachment is harmless.
Verify the task outside the attachment
Ask whether you expected this particular document, from this person, for this purpose. If not, contact the sender through a previously known number or address. Do not rely on contact details supplied only inside the suspicious message.
A practical question is: “Did you send this file, and why does the invoice need macros?” For a document intended only to communicate figures, requesting a plain PDF or another non-executable format may resolve the legitimate need without running the original attachment.
Keep the warning in place
Do not disable a security setting merely because the document’s own instructions tell you to. On a managed work computer, ask the IT team to review the file and the business requirement. Legitimate automation should have an approved distribution and trust process.
If you already enabled unexpected content, contact your security support promptly and follow its incident procedure. Preserve the message and explain what you clicked; do not conceal the event or keep experimenting to see whether the file eventually opens.
The useful habit is a short pause before granting execution. A recognisable logo, an urgent deadline and a familiar-looking filename are presentation details. None independently establishes who supplied the code or what it will do.