Show File Extensions in Windows 11 and 10 to Spot PDF.exe Phishing Attachments

In a personal account published by MakeUseOf, writer Oluwaseun Bamisile described nearly walking right into that exact trap after downloading an email attachment while expecting a legitimate invoice. According to Bamisile's account, the downloaded file carried a familiar PDF icon, yet inspecting it in Windows File Explorer with the File name extensions option turned on revealed the full name: Oluwaseun Invoice.pdf.exe. Because that account is a personal anecdote rather than an independent forensic teardown, there is no outside verification of what payload the executable carried or what would have happened had it been launched. Still, the technical mechanism it highlights is one of the oldest and most reliable tricks in the Windows phishing playbook—and one that takes about five seconds to expose.

The Anatomy of the Double-Extension Trick​

Why does a filename like Oluwaseun Invoice.pdf.exe still fool people in an era of cloud-backed endpoint protection? It comes down to how Windows parses filenames and how File Explorer presents them when extensions are hidden.

According to Microsoft Support documentation on common file name extensions in Windows, a Windows filename is divided into two parts separated by a period: the base name and a three- or four-character extension that defines the file type, tells the operating system which application can open it, and determines which icon to display. When a filename contains multiple periods, Windows looks at the final suffix to determine the actual file type.

In Oluwaseun Invoice.pdf.exe, the .pdf sitting in the middle has zero authority over how Windows treats the file. It is merely decorative text inside the base filename, no different from spaces or letters. The real extension is .exe, which Microsoft Support classifies as an executable program file. As cybersecurity firm Guardian Digital notes in its guidance on PDF threats, when Windows hides the ending of a filename, switching that display option on reveals that a file like invoice.pdf.exe is a program regardless of what the first part of its name says.

Microsoft Support also points out that changing a filename extension does not convert a file to another format or alter anything about it besides its name. Conversely, slapping .pdf into the middle of an executable's name does not turn a program into an Adobe Acrobat document. And while Microsoft notes that extensions normally dictate which icon File Explorer displays, executable files can be packaged with custom embedded icons—meaning a program file can easily dress up in a PDF icon to complete the illusion. If extensions are hidden in File Explorer, the .exe suffix is stripped from view, leaving the user staring at a PDF icon and a label reading Oluwaseun Invoice.pdf.

Section Summary:

• Windows uses the final suffix after the last period to identify a file's type, while any earlier .pdf string in a name like Invoice.pdf.exe is just plain text.
• Hiding extensions in File Explorer conceals the trailing .exe, making an executable program look like a standard document.
• Custom icons on executable files can mimic document icons, making visible file extensions a vital sanity check before double-clicking.

How to Show File Name Extensions in Windows 11 and Windows 10​

You do not need third-party utilities, registry hacks, or a system reboot to make Windows show the full truth about your files. Microsoft Support and Microsoft Learn document several straightforward ways to turn this visibility on across Windows 11 and Windows 10.

1. The Standard File Explorer Method (Windows 11)​

According to Microsoft Support and MakeUseOf, if you do not see file name extensions when viewing files in Windows 11:

1. Open File Explorer (you can type file explorer into the taskbar search box and select it from the results).
2. On the top toolbar, select View.
3. Hover over Show, and click File name extensions so that a checkmark appears next to it.

2. The Ribbon Method (Windows 10)​

If you are still working on a Windows 10 machine, the option sits right on the classic ribbon interface. As documented by Microsoft Support and MakeUseOf:

1. Open File Explorer.
2. Select the View tab at the top of the window.
3. In the Show/hide group, check the File name extensions box.

(Note for Windows 10 holdouts: Microsoft Support explicitly notes that free software updates, technical assistance, and security fixes for Windows 10 ended after October 14, 2025. Showing file extensions will still help you spot crude filename tricks on an older PC, but running an unsupported operating system carries broader security risks that a File Explorer toggle cannot fix.)

3. The Windows Settings Method (Windows 11, version 25H2 and later)​

For power users and developers running newer builds of Windows 11, Microsoft has also surfaced this toggle inside the main Settings app. According to Microsoft Learn documentation on Advanced Windows Settings, starting in Windows 11, version 25H2 and later, the former "For developers" page is located at System > Advanced in Windows Settings. Under the File Explorer category on that page, you can directly toggle Show file extensions alongside other power-user options like showing hidden and system files or displaying the full path in the title bar. Microsoft Learn notes that on devices managed by an organization, IT administrators may apply policies that disable these Advanced settings toggles.

Section Summary:

• Enabling File name extensions in File Explorer takes effect immediately across the system without requiring a restart.
• Windows 11 users can toggle it via View > Show > File name extensions or, on version 25H2 and later, under Settings > System > Advanced.
• Windows 10 users can enable it in the File Explorer View tab under the Show/hide group.

Know Which Extensions Demand Extra Caution​

Once File Explorer starts showing every suffix, what should actually set off alarm bells when you are expecting a mundane document, spreadsheet, or image? MakeUseOf's Bamisile highlights .exe, .msi, .bat, .cmd, and .scr as extensions that require extreme caution because they can represent executable programs or scripts rather than static documents.

Looking at Microsoft Support's official table of common Windows file name extensions helps clarify what several of these suffixes—and a few related document formats—actually do:

• .exe: Executable program file. A legitimate bill, receipt, or contract will never arrive as an .exe.
• .msi: Microsoft installer file. Used to install software packages onto Windows, never to deliver a static invoice.
• .bat: PC batch file. Contains command-line instructions that Windows can execute.
• Macro-enabled Office formats (.docm, .xlsm, .pptm): While standard post-2007 Office documents end in .docx, .xlsx, or .pptx, Microsoft Support classifies .docm, .xlsm, and .pptm as macro-enabled documents, workbooks, and presentations. Seeing an m at the end of an Office extension means the file can carry embedded macro code.

If you download a supposed PDF invoice or shipping manifest and see .exe, .msi, or .bat sitting at the end of the filename, do not double-click it out of curiosity to see what happens. Delete it immediately.

Why Visibility Is Only One Layer of Defense​

As satisfying as it is to catch a phony .pdf.exe red-handed, any honest security analysis has to stress what this setting cannot do. Turning on File name extensions is a visibility aid, not a security barrier. It does not scan files, block execution, or verify that a file's contents are harmless.

Furthermore, a real .pdf suffix does not guarantee a safe file. As Guardian Digital and MakeUseOf point out, a genuine PDF document with a legitimate .pdf extension can still be weaponized. Attackers frequently use real PDFs to display deceptive "View account" buttons, malicious web links, QR codes that route victims to cloned login pages, or fake billing phone numbers designed for voice-phishing scams. Security guides from MundoBytes and NordVPN also note that malicious PDFs can exploit vulnerabilities in outdated PDF readers or abuse embedded features like Acrobat JavaScript.

To build a practical defense-in-depth routine on Windows, pair visible file extensions with a few grounded habits:

• Verify the sender even when the timing matches: Phishing lures succeed most often when they align with something you are already waiting for, such as an invoice, tax form, or delivery notice. Inspect the actual sender address for subtle domain typos before downloading attachments.
• Keep Microsoft Defender active and updated: Ensure your built-in antivirus protection—or your preferred endpoint security suite—is running with current definitions so it can inspect and quarantine known threats before they open.
• Resist "investigative" clicking: Never open a suspicious attachment just to see what it looks like inside. If a business contact sends an unexpected executable or strange archive, verify the message with them through a separate, trusted communication channel.

Take ten seconds right now to open File Explorer and make sure File name extensions is checked. Have you ever caught a disguised attachment masquerading behind a double extension in your own inbox? Share your close calls and favorite Windows hardening tips in the WindowsForum community discussions!