Before You Double-Click: How to Tell a Genuine Update From a Very Good Fake

The email lands on a Tuesday morning. It says your accounts package has a critical update, the button is green, and the logo looks right. Someone in the office clicks it. That is all it takes. Not because your team is careless, but because software updates are supposed to arrive, and most of us have been trained to say yes to them.

The awkward truth is that an update is just a file from the internet asking for trust. Sometimes that trust is earned. Sometimes it is borrowed from a real brand by someone who has copied the logo and picked a domain name one letter away from the real one. The seal on the installer — the certificate, the checksum, the official download page — is only useful if someone actually looks at it.

This is a small-team routine for doing exactly that, without turning every update into a project.

Start at the source, not the link

The first rule is boring and effective: never install an update from a link you did not go looking for. If a prompt says a tool needs updating, close it and open the vendor’s site yourself. Type the address, or use a bookmark your team already trusts. Do not search for “download [product] update” and click the first sponsored result. Lookalike domains are cheap, and adverts are not a verification service.

For common tools, go one step further. Use the vendor’s official release notes page to confirm that an update actually exists. If the release notes say version 8.4 shipped last week and the prompt is offering 8.5.1 with no mention anywhere, that is a reason to pause, not a reason to feel special.

A useful habit for small teams is to keep a short list of approved download pages in a shared document or password manager. It sounds almost too simple, but it removes the moment of improvisation when someone needs a download in a hurry.

Look at the certificate, not the logo

Logos prove nothing. A criminal can copy a logo in about four minutes. Code-signing certificates are more interesting, because they attach an identity to the file and show whether the file has been altered since it was signed.

On Windows, right-click the installer, choose Properties, then Digital Signatures. You should see a signer name that matches the vendor. Click Details and check the certificate. If it says “Unknown publisher”, or the signer is a company you have never heard of, stop. SmartScreen warnings are not perfect, but a warning combined with an odd publisher is a strong signal to walk away.

On macOS, you can inspect an app or disk image with the certificate tools or simply try to open it and read the Gatekeeper message carefully. A genuinely notarised app from a known developer should show the developer’s name. “Unidentified developer” is not automatically malicious — plenty of small utilities are unsigned — but it means you are taking on more risk than the packaging suggests.

The important point is that a valid signature proves who signed the file and that it has not changed since. It does not prove the software is safe, well written or free from vulnerabilities. A signed installer from a real vendor can still be a bad update. A signature is a receipt, not a reference.

Check the checksum if the vendor publishes one

A checksum is a fingerprint of the file. Vendors often publish SHA-256 hashes next to downloads. You do not need to be a developer to use one.

On Windows, open PowerShell and run Get-FileHash .\installer.exe -Algorithm SHA256. On macOS, use shasum -a 256 installer.dmg. Compare the long string with the one on the vendor’s site. If they match, the file you have is the file they published. If they do not, delete it and start again from the official page.

This is not magic. If the vendor’s own site is compromised, the checksum can be wrong too. But it catches the very common case of a file that has been swapped somewhere between the download page and your laptop.

Know what each platform is actually telling you

Windows code signing and SmartScreen are useful signals, but they are not a safety certificate. SmartScreen reputation can be thin for new or niche software. macOS Gatekeeper and notarisation reduce the chance of running something obviously dodgy, but they do not audit the code for you. Package registries such as npm, PyPI or NuGet can show provenance and publisher information, but a maintainer account can still be taken over. None of these systems replaces the question: did this update come from the place we expected, and do we actually need it?

For small UK teams, the practical answer is to combine signals. Official source, matching publisher, sensible release notes, checksum where available. If two or three of those are missing, treat the update as unverified.

The warning signs worth teaching

Most fake updates give themselves away somewhere. The download page has a slightly wrong domain. The installer asks for administrator rights when the tool has never needed them before. The file name is something like update_setup_final_v2.exe rather than the vendor’s usual naming. The release notes are a single line of marketing fluff. The prompt arrives by email or pop-up rather than through the app’s own update mechanism. The site asks you to disable your antivirus before installing. Any one of those is a reason to stop and check.

Urgency is the oldest trick in the book. “Your licence expires today” or “critical security patch” is designed to move you past the verification step. Real vendors do publish urgent updates, but they do not usually deliver them through a random link in an email.

The day someone clicks

It happens. The response should be calm and written down before it is needed.

First, disconnect the machine from the network. Do not shut it down if your team may need to investigate; pull the cable or disable Wi-Fi. Second, tell whoever handles IT, even if that is you. Third, change passwords for anything that was logged in on that machine, starting with email and finance tools. Fourth, check for unusual sign-in activity and new rules in email accounts. Fifth, report it. In the UK, Action Fraud is the place to log a suspected fraud, and the NCSC has practical guidance for small organisations. If money has moved, call the bank immediately.

Do not spend the afternoon trying to “clean” the machine with a free scanner and hoping for the best. A rebuilt device is usually faster and more certain than a repaired one.

Make the routine boring

The goal is not to turn every update into a security review. It is to make the check normal. Keep approved download links in one place. Ask vendors to publish checksums. Teach everyone the difference between a logo and a certificate. And make it acceptable to say, “I’m not installing that until we check where it came from.”

A seal on an installer is only worth something when someone reads it. The rest of the time, it is just a nice picture.