A fake security alert tries to make you act fast, usually by clicking a link, installing a patch or entering credentials. Check where the message came from, whether the link goes to the real domain, whether the ask makes sense, and then open the vendor's advisory by typing the address or using a bookmark rather than the message link.
Why alerts are a good disguise
During real incidents people expect urgent messages about patches and password resets. Attackers know that and send copies. A message that says "your account was in the breach in the news, reset now" is believable because the news is real.
Five quick checks
- Sender. Look at the full address, not just the display name. Be wary of look alike domains.
- Link. Hover to see the destination before clicking. A link that does not match the company's real domain is a warning sign.
- Ask. Real advisories tell you to update to a named version. They do not ask for your password or for remote access to your machine.
- Pressure. Deadlines like "within the hour or the account closes" are a pressure tactic.
- Attachments. A patch delivered as an email attachment is a red flag. Real vendors publish fixes on their own sites or through their update mechanism.
Verify through a path you control
Go to the vendor's website by typing the address or using a saved bookmark, and look for the advisory there. For a breach notice that says to reset a password, open the service yourself and use its own reset flow. Do not use the message's link.
Be careful with fake proof of concept code
After a famous flaw is published, fake exploit repositories appear that carry malware aimed at researchers and defenders. Review code before running it, run it in an isolated environment, and prefer sources you know.
Set team habits
Agree that security alerts are verified through the internal channel before anyone acts. Give people a simple way to report a suspect message, and thank them even when it turns out to be real. Practice with a short exercise now and then.
If you clicked
Do not hide it. Tell your security contact quickly, change the password from a clean device, and review recent activity. Speed matters more than blame. The FTC guide for businesses stresses acting quickly to contain a problem and updating credentials, since stolen credentials stay useful to attackers until changed.
Quick check
How can I check an advisory is real?
Find it on the vendor's own security page, reached by typing the address or using a bookmark, and compare version numbers and wording.
Is it safe to download exploit code from a news story?
Treat it as untrusted. Read it first and run it only in an isolated environment.
Sources
Last reviewed: 19 October 2026.
