Did I really get a critical update notification for Outlook Express in my email?

Home » EMail » Spam

Summary: Emails that look like a critical update from Microsoft are scams. We'll look at exactly what makes the scam obvious.

•

Delete that email immediately, and ignore any more copies you'll likely get.

Malware authors are constantly looking for ways to fool us into clicking on their links. Since I also got the same email, I'll use it as an example of what to look for.

•

Here's the email in question:

Here's the problem:

It's Totally Bogus

That link that looks like it goes to "http://update.microsoft.com/..."? In the email it looks like that, but if you click on it your browser will really go to "http://update.microsoft.com.ilkihi.com/...". See how there's an extra domain in the URL that's not in the URL that you click on?

That's the single biggest clue that this is a scam. Click on it, and you'll likely take a virus, or be the victim of some other kind of scam - particularly if you accept and install the download.

What scam artists have done is create an email that looks as much as possible like an official email from Microsoft. They've probably even copy/pasted from a real Microsoft email or web page to get the look and feel just right. Many of the other links in that email might happen to be correct, and take you to the corresponding page on Microsoft's web site. That's even a legitimate Knowledgebase identifier, though the real article has nothing to do with what the email claims.

What they're counting on is enough people blindly assuming that the email is legitimate, and clicking on the download link because they think they need this "update".

How do you protect yourself?

• Realize that Microsoft never distributes updates via email. Not as a an attachment, and not even as instructions to download.

• Never click on links in email that you didn't expect, or aren't 100% certain about. Never. Remember, even the technique of hovering over a link to see where it "really" goes can also many times be spoofed - you can't trust even that.

• Always keep your machine up to date. If it's updates you want, then enable Windows Automatic Updates, or visit Windows Update yourself. It's also a great way to check out the legitimacy of emails like this: if you visit Windows Update, you'll be notified there if you do indeed need some update.

I'm seeing this scam more and more often, so please - be careful, and watch where you click.

Related:

Helpful? Get new articles weekly by email in my FREE newsletter!

Your Name:
Your Email:

Why Subscribe?

• Why does my email program think that this message might be a scam? Occasionally, security software examines links in email and alerts you if something is suspicious. Frequently, as in my newsletter, it's totally benign.

• Phishing? What's Phishing? Phishing is a way that internet scammers trick you into providing your personal and financial details. Phishing opens the door to identity theft, and more.

• Did I really just win an email lottery or sweepstakes? We all receive emails that indicate we've won several different lotteries. Are any of these winning notifications valid? I'll review what to look for.

Article C3770 - June 22, 2009