Ask for an attachment only when it enables a concrete decision or action: finding an order, assessing damage, confirming a payment, or understanding a request. Tell the customer which file is useful, which part of it you need, and which approved channel to use. Then treat the file as part of a case with an owner, a purpose, and a review point—not as an image floating in a group chat or personal inbox.
Use five stages: a minimal request, receipt through an approved channel, checks before opening, access limited to people doing the work, and closure under the organisation's retention rules. If a file arrives in the wrong place, guide the customer to a safer route without copying it into more systems. Do not promise automatic scanning, encryption, or deletion unless those controls are verified in your actual environment.
Request only the file the decision requires
Start with the operational question: what decision depends on this attachment? For a delivery issue, an order number and a photo of the package may be enough. For a billing dispute, the relevant part of a receipt may show the date, amount, and reference. Avoid asking for a complete identity document, full bank details, or images of other people when a smaller piece of evidence will do. The guide to first-contact questions helps separate necessary information from habitual collection.
Make the request specific. “Please send a clear photo of the label and damaged area, without unrelated personal details” is easier to act on than “send all your documents.” State only the file types and size limits that the real workflow accepts, and offer another route if the customer cannot use that channel. Where identity, payment, or sensitive information is involved, follow the company's approved procedure; a support agent should not improvise a document collection process for convenience.
Record why the file was requested and who requested it. That keeps the next agent from asking for the same material again. If the customer sends more than needed, do not reproduce the excess in notes, screenshots, or internal messages. The team can record that sufficient evidence arrived and move to the next action without multiplying copies. Guidance from Brazil's data-protection authority, ANPD, offers a starting point for security and access controls, while each organisation still needs rules suited to its own process and risk.
Check files before opening or distributing them
A name ending in .pdf or .jpg is not proof that the content is safe. The OWASP File Upload Cheat Sheet recommends layered controls: allow only necessary file types, validate the actual type, limit size, protect filenames and storage, and use malware scanning or isolation when available. A sender-provided content-type header can be spoofed. These checks belong in the approved system and security process, not in an agent's guess about whether an icon looks familiar.
Design the flow so files do not open automatically on an agent's device or spread to colleagues before the required checks. If the current channel lacks a technical control, do not pretend it has one. Restrict what is accepted, use the approved corporate route, and escalate the exception to the responsible team. An unexpected executable, archive, or file whose appearance does not match its stated type should not be tested casually on a personal computer.
Separate a rejected file from a failed support case. When an upload cannot be accepted, the customer needs a simple explanation of what to correct and how to try again, without details that would help bypass security. Keep the case open with an owner and a review time. The conversation should continue even when the evidence cannot yet be used. An escalation rule can distinguish an ordinary format question from an incident that needs specialist response.
Limit access, forwarding, and unnecessary copies
Once accepted, the file should stay linked to the right case and visible only to people with a legitimate task. Define who may receive, view, download, forward, and remove it. Review permissions when a case moves teams, someone leaves a project, or a supplier becomes involved. The ANPD security guide discusses administrative and technical controls; in support work, that means proportionate access, named responsibility, and a useful record of relevant actions.
Avoid turning one attachment into a chain of forwarded emails, internal chats, and personal folders. Prefer a reference to the authorised case record and a summary of what was checked. If a specialist team needs the file, record the transfer, purpose, and accepting owner. The guide to handoffs with context explains why a change of responsibility needs acceptance and a next action, not merely another copy of the content.
A photo may contain more than the object of interest: a face, address, shipping label, location, or another document in the background. Teach the team to notice that excess before sharing. When a crop or extracted fact is enough for downstream work, keep the original only in the authorised location and circulate the minimum necessary. Do not alter the original in a way that undermines later review; record which version was used and why.
Plan retention, closure, and incident response
Closing a conversation does not automatically determine how long its attachment should remain. The organisation needs a rule by case type, applicable obligation, and purpose, with an owner for the decision and a review mechanism. Avoid deleting evidence impulsively while it is still needed, but also avoid indefinite storage “just in case.” Agents should know which state closes the case and where to refer a retention question. Do not invent a universal legal retention period.
If a file reaches the wrong recipient, becomes accessible to someone who should not see it, or appears malicious, stop further sharing and invoke the company's security and privacy process. Preserve the facts needed to investigate: case reference, time, channel, authorised participants, and actions taken. Do not tell the customer that nothing happened before the facts are established. External response and any regulatory communication require specialist assessment; this operational guide does not replace that decision.
Review a sample of cases: how many files were requested without need, arrived through the wrong channel, failed checks, produced extra copies, or retained access after the task ended? Use concrete findings to improve instructions, permissions, and training. The best flow is not the one that accepts every file fastest. It collects the right evidence, protects the customer, and leaves a clear trail of what the team decided.
- The case states why the file is needed and which part is sufficient.
- The customer has an approved channel and clear format instructions.
- Type, size, and content meet the available checks before opening.
- Unexpected or suspicious files follow an exception route.
- Only authorised people can access or forward the file.
- Extra copies and data are avoided; transfers have an owner.
- Retention, closure, and incident response follow company policy.