How to Tell Real Security Warnings From Fake Ones
Some security alerts are genuine and important; many are fake. Where real alerts appear, how they behave, and the requests that reveal a fake warning every time.
Security warnings matter. A genuine alert about a new sign-in to your email can help you stop an account takeover. But scammers know people take warnings seriously, so they fake them: pop-ups, emails, texts and notifications that look like alerts from Microsoft, Apple, Google, your bank or your antivirus. Here is how to tell the difference.
Where real warnings appear
| Source | Where the genuine alert appears |
|---|---|
| Your operating system | System notifications and the built-in security app (such as Windows Security), not a web page. |
| Your antivirus | The antivirus program's own window or notification. |
| Your email or social media | Emails from the provider, and the security or recent activity page when you log in yourself. |
| Your bank | The official banking app, and messages that do not ask for codes or links to log in. |
| Your browser | Full-page warnings before you visit a known dangerous site, which tell you to go back, not to call anyone. |
What fake warnings ask you to do
The clearest way to spot a fake is by its request. Fake warnings ask you to:
- call a phone number
- install an app or "cleaner"
- allow remote access
- pay to remove viruses or unlock your device
- enter your password on a linked page
- share a code
- tap "Allow" for notifications
Genuine warnings usually tell you to go back, update your software, change your password through your account, or review activity. They do not require you to contact a stranger or pay.
The safest rule: never act on the alert itself. Open the official app or website yourself and check there.
Side-by-side examples
- Even if it looks genuine, do not tap the button. Open the account yourself and check recent activity.
- A phone number, panic, and instructions not to turn off your device.
Warnings on phones
- Notifications that show a browser name and a website are from a site you allowed. See browser notification scams.
- Genuine app store security checks, such as Google Play Protect on Android, appear within the store or system settings.
- Text messages that say your account is locked and include a link are almost always phishing.
Build the habit
- Pause when you see a warning.
- Close pop-ups and do not follow links in alerts.
- Check through the official app or website you already use.
- Keep your software updated so genuine protections work.
Not sure about an alert? Paste it or a screenshot into CyberWatch AI Scan for a free check.
Fake warnings are the front door to tech support pop-up scams. For the bigger picture of how online scams work, read our complete guide.
Frequently asked questions
How do I know if a sign-in alert from my email provider is real?
Do not use links in the alert. Open the provider's app or website yourself and check the security or recent activity section. If the alert is real, it will be recorded there.
Is a warning from my antivirus real?
Genuine alerts come from the antivirus program installed on your device, appear in its own window or notification, and never ask you to call a phone number or pay by gift card.
What if I ignore a real warning by mistake?
If you regularly check your accounts through official apps, you will still see genuine security issues there. Checking independently is safer than acting on any alert directly.
Sources
- How To Spot, Avoid, and Report Tech Support Scams, US Federal Trade Commission
- Device security guidance, UK National Cyber Security Centre
- How To Recognize and Avoid Phishing Scams, US Federal Trade Commission
