A computer-implemented method for detecting suspicious files may include (1) detecting a file within incoming file traffic directed to a file recipient, (2) identifying a type of the file within the incoming file traffic directed to the file recipient, (3) determining a frequency with which the type of the file appears within the incoming file traffic directed to the file recipient, and (4) performing a security action on the file in response to the frequency of the type of the file within the incoming file traffic falling below a predetermined threshold. Various other methods, systems, and computer-readable media are also disclosed.