Fake Software Update Scams on Email
Fraudulent emails pose as urgent software or security updates, tricking recipients into downloading malware disguised as a patch or driver.
Part of: Fake Software Update Scams
Last reviewed: 1 June 2026
A fake update email mimics the routine notices people receive from operating systems, browsers, and apps: a 'critical security update', an 'expired plugin', a 'driver that must be installed'. In a busy inbox the request feels mundane and is easy to action without thought.
Genuine software updates are delivered through the application itself or the official store, not through unsolicited email attachments and links. Scammers exploit the habit of accepting updates, using official-looking branding to disguise malware as a necessary patch.
How this scam works on Email
The email warns that your software is out of date, vulnerable, or about to stop working, and provides a link or attachment to 'install the update' immediately.
The link leads to a fake download page styled like the vendor's, or the attachment is an installer that delivers malware, ransomware, or a remote-access tool. The branding and urgent security language are calibrated to look like a routine, trustworthy prompt.
Once installed, the malware can steal data, encrypt files, or open the device to the scammer — all under the guise of having kept the software current.
Common red flags
- An email urges you to install a critical software or security update
- A link or attachment is provided to 'update' rather than the app itself
- You are warned the software will break or be unsafe unless you act now
- The sender address does not match the vendor's official domain
- The download page's address differs from the official site
- The 'update' is an executable attachment
How to protect yourself
- Install updates only through the app itself or the official app store
- Never run update installers attached to or linked from an email
- Treat urgent 'your software is unsafe' emails as suspect
- Check the sender's full address against the vendor's official domain
- Enable automatic updates from the genuine source where possible
- Report the email via your provider's phishing tool and delete it
How to report it
- Use your email provider's 'Report phishing' function on the message
- Report the impersonation to the software vendor via its official site
- File a report with your national fraud or cybercrime reporting centre
Frequently asked questions
I ran the installer from a fake update email — what should I do now?
Disconnect the device from the internet and run a scan with reputable, trusted security software as soon as possible to check for malware. Change your important passwords from a separate, uncompromised device, and consider having a professional check the device if problems persist.
Why do fake update emails often target specific software like browsers or media players?
Widely used software gives scammers a large pool of potential targets, since almost everyone has installed a browser, media player, or similar common application. Genuine updates for this kind of software are delivered automatically or through the application's own update check, never through an unsolicited email.
How can I tell if my software genuinely needs an update?
Check for updates within the application itself, usually through a settings or 'About' menu, or through your device's official app store, rather than trusting an external prompt. Enabling automatic updates from the genuine source is the most reliable way to stay current.
Should I install an update from an email link?
No. Genuine updates come through the application or the official app store, never through an emailed link or attachment. Such files typically deliver malware. Update only from the trusted source built into the software.