Security update scam emails: how to spot a fake alert

MacWindowsiPhoneAndroidUpdated

The UK's National Cyber Security Centre (NCSC) lists "current events" among the signs of a scam: criminals often use news stories and big events to make a message seem relevant. An email urging you to install an urgent security update or sign in to fix a security problem deserves a second look, and the safe check is always the same. Don't use its links. Go to the company yourself.

Quick answer

Treat any unexpected email about an urgent security update, alert or account problem as suspect. Signs include pressure to act fast, a sender or link that doesn't match the company, and requests for passwords or codes. Don't click. Check by going to the company's website or app yourself. In the UK, forward suspicious emails to report@phishing.gov.uk.

How do I spot a fake security update email?

Look at what the message wants from you and how hard it pushes. The NCSC says scammers try to gain your trust quickly and pressure you into acting without thinking. Its tell-tale signs include:

  • Authority: it claims to come from someone official, such as your bank or a government department.
  • Urgency: you're given a limited time to respond, such as "within 24 hours", sometimes with a threat attached.
  • Emotion: it's written to make you panic, or curious enough to click.
  • Current events: it ties itself to something in the news.

Apple's list of signs is about the details:

  1. The sender's email address doesn't match the name of the company it claims to be from.
  2. A link looks right, but the URL doesn't match the company's website.
  3. The message looks quite different from others you've had from that company.
  4. It asks for personal information, such as a card number or a password.
  5. It's unsolicited and has an attachment.

The US Federal Trade Commission (FTC) adds the stories these emails tend to tell: that there's been suspicious activity or log-in attempts, a problem with your account, or that you need to confirm personal details.

The NCSC also warns that spotting scams is harder than it was. Bad spelling and odd design used to give them away, but it says scams are getting smarter and some even fool the experts. A polished email isn't proof of anything.

Do Apple and Microsoft send security warnings like this?

Not the kind that asks for your password. Apple says it will never ask you to log in to any website, or to provide your password, device passcode or two-factor authentication code. It also warns that scammers sometimes ask people to turn off security features such as two-factor authentication. It also says that if you're suspicious of an unexpected request for personal information, it's safer to presume it's a scam.

Microsoft says it will never proactively contact you to offer unsolicited PC or technical support, and that genuine Microsoft error messages never include a phone number to call. On update prompts specifically, it advises that if you get an unusual notice saying your browser needs to be updated, close the message and check for updates from the browser's own Help or About page. It notes attackers disguise malware as a browser update.

What about pop-ups saying my device has a virus?

Close them. Apple says that if a pop-up or alert warns about security problems or viruses on your device, don't believe it: these are usually fraudulent adverts meant to get you to download harmful software or hand over information or money. Don't call the number or follow the links. Navigate away, or close the whole window or tab. Our guide to whether visiting a hacked website can hack you covers browser warnings in more detail.

Are there scam emails about the PHP vulnerability?

As of 23 October 2026, neither the PHP project's advisory nor the NCSC's alert on PHP2Shell, the pair of critical PHP flaws fixed on 21 October, reports scam emails using it as a theme. That could change, and the NCSC's general warning still applies: criminals often exploit current news stories.

It helps to know who the fix is for. The PHP project's advisory is about PHP installations serving web requests, and the NCSC's alert is addressed to organisations, asking them to find and update the PHP they run. Neither of them asks members of the public to download anything or sign in anywhere. Our guide to PHP2Shell and your personal data explains what it does and doesn't mean for you.

How do I check whether a security email is real?

Contact the company without using anything in the message. The NCSC says to use the details from the organisation's official website, not the numbers or addresses in the message. Microsoft suggests opening a new browser tab and going to the organisation's site from your own saved favourite, or typing its address yourself.

  1. Don't click the links, open the attachments or ring the numbers in the email.
  2. Open the company's app, or type its web address yourself.
  3. If you're still unsure, contact the company through its official website.

How do I report a scam security email?

In the UK, forward it to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk. The NCSC says to send anything that feels suspicious, even if you're not certain, and not to click its links. You don't need to forward suspicious emails that are already in your spam or junk folder. Scam texts go to 7726.

  • Emails that look like they're from Apple: forward them to reportphishing@apple.com.
  • Tech support scams: Microsoft takes reports at microsoft.com/reportascam.
  • In the US: the FTC says to forward phishing emails to reportphishing@apwg.org and report the attempt at ReportFraud.ftc.gov.

If you've lost money, the NCSC says to tell your bank and report it to Report Fraud (in Scotland, call the police on 101).

Banking apps down on 20 October 2026? The Google Cloud outage guide explains what Google says happened and what to do when your bank's app is down.

More questions

I typed my password into a link from one of these emails. What now?

Change that password straight away, through the real site or app, and anywhere else you used it. For an Apple Account, Apple says to change the password immediately and make sure two-factor authentication is on. If you think you may have lost money, contact your bank.

I clicked a link or opened an attachment. What should I do?

The FTC says to update your computer's security software, run a scan, and remove anything it flags. If you think a scammer has your information, it points US readers to IdentityTheft.gov for recovery steps.

What happens after I report an email to the NCSC?

The NCSC says it analyses the email and any websites it links to, and may work with hosting companies to remove malicious links. It can't tell you the outcome, but says it acts on every message it receives.

My forwarded email bounced. Did the report fail?

Not necessarily. The NCSC says an error message can come from the way some email providers handle suspicious emails. If the email had only one link, the error means it's already been recognised as spam. If it had several, try sending each link separately.

Will my bank email me to confirm my details?

The NCSC says your bank, or any other official organisation, will never ask you to supply personal information by email. If a message asks for that, contact the bank using the number on your card or its official website.

Sources