Google's attachments page lists three reasons Gmail may label an attachment suspicious instead of clearing it. The one that matters most: "Some attachments, like documents that require a password to open, are encrypted and can't be scanned for viruses." The other two are attachments that allow "unverified scripts", and forwarded emails attached as `.eml` files, where Gmail checks the contents but "can't confirm that the sender in the .eml files actually sent those emails" ([*Open & download attachments in Gmail*](https://support.google.com/mail/answer/30719), read 1 October 2026).
Google's advice on the same page is short: "If the email looks suspicious, don't reply and don't download the attachment." It also says the opposite case plainly: "If the email is from someone you know and trust, ignore the warning." A password-protected file from a colleague who told you the password is the expected case; the same file from a stranger, with the password in the email body, is the classic way past a scanner.
## Links are a separate checkAn attachment scan does nothing about a link in the message text. Google handles links differently: it "adds link protection for all official Gmail clients (web, Android, and iPhone & iPad)". If you read your Gmail in another app such as Apple Mail or Outlook, the same page describes the protection there as "a small test" for some users ([*Click-time link protections in third-party email clients*](https://support.google.com/mail/answer/10173182), read 1 October 2026). So the app you read mail in can change how much checking a link gets before you open it.
Phishing is a third mechanism again. Google says Gmail "is designed to help protect your account by automatically identifying phishing emails", and that a suspected one may get "a warning" or be moved "to Spam" ([*Avoid & report phishing emails*](https://support.google.com/mail/answer/8253), read 1 October 2026). A message can pass the virus scan and still be a phishing email: the scan looks at files, not at what the message is asking you to do.
## What Google does not tell youThe anti-virus page says nothing about how the scanning works: no engine, no update schedule, no detection rate. Its wording is that Gmail rejects mail when it finds "a known virus"; it makes no claim about threats that are not yet known ([*Anti-virus scanning attachments*](https://support.google.com/mail/answer/25760), read 1 October 2026). We are not going to fill that gap with a guess. The practical reading is that the scan is a strong net, not a guarantee.
## What that means for you