Google Drive displays a warning banner when it identifies an opened file as potentially suspicious or dangerous. Google announced the feature on January 20, 2022, to help protect users and organizations from malware, phishing, and ransomware. A separate “External” indicator identifies files owned by or shared from outside your organization; it does not, by itself, mean Google detected malware.
What the suspicious-file banner means
Google’s January 20, 2022 announcement says Drive shows a warning when a user opens a potentially suspicious or dangerous file. The stated aim is to help protect people and their organizations from malware, phishing, and ransomware.
The announcement does not specify the exact criteria or signals that cause a particular file to receive this warning. Google’s broader security guidance describes scanning practices, but it does not explain the banner’s classification process or promise that every file is scanned.
Google said the banner would roll out gradually, with visibility taking up to 15 days from January 20, 2022. That was the original rollout schedule, not a recurring deadline.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhere warnings appear
Google later extended suspicious-file warnings to Docs, Sheets, and Slides files opened on the web. Its April 27, 2022 announcement described another gradual rollout of up to 15 days, starting that date.
How to distinguish it from an External warning
Google has more than one kind of file warning. Identify the alert by its wording and context, rather than relying on its color alone.
Quick Recap
Best Value
#1 Best Overall
| Alert | What it indicates | Context |
|---|---|---|
| Suspicious-file banner | Google considers the file potentially suspicious or dangerous. The stated protection concerns malware, phishing, and ransomware. | Announced for Drive in January 2022 and extended to Docs, Sheets, and Slides on the web in April 2022. Google, January 2022; Google, April 2022. |
| External or out-of-domain indicator | The file is owned by or shared with someone outside the user’s organization. It signals outside ownership or sharing, not a malware finding. | Publicly launched in April 2025, with additional contexts announced in May 2026. Google, April 2025; Google, May 2026. |
| Scan-failure caution | Google could not complete a security scan. Its help guidance advises caution; some file types cannot be scanned. | General Drive security guidance, not an explanation of why a particular suspicious-file banner appeared. Google states a 100 MB scanning limit. Google Drive Help. |
The External indicator is a separate feature from the suspicious-file banner. Google announced its public availability on April 28, 2025, and further coverage for mobile, sharing, and notifications on May 26, 2026. For that separate out-of-domain warning feature, Google says administrators can configure the warnings; its 2026 update says the feature is on by default and can be disabled at the domain or organizational level.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do when you see a warning
- Pause before opening or acting on the file. Treat a suspicious-file banner as a reason to assess the file, not as proof that an accessible file is safe.
- Check the message. Determine whether it says the file is suspicious, identifies it as external, or says a scan could not be completed. Those messages describe different things.
- If a scan failed, use caution. Google’s Drive security help says some file types cannot be scanned and gives a 100 MB scanning limit. That limit is general security-scanning guidance, not the trigger for the suspicious-file banner.
- For an External indicator, consider who owns or shared the file. An outside-domain label is not a finding that the file contains malware.
Can you turn off the suspicious-file banner?
Google’s January 2022 announcement says there is no administrator control or end-user setting for the suspicious-file banner feature. Do not confuse that with controls for the separate External warning feature, which Google says administrators can configure.
What Google has not disclosed
The launch announcement does not state the precise detection rules or thresholds behind a suspicious-file warning. Google also has not reported a measured reduction in malware infections, phishing, ransomware, or user errors attributable to these banners. The rollout schedule and scan-size limit are not effectiveness statistics.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
