Week 20: E-mails warning of fake viruses

20.05.2025 - Cybercriminals are constantly trying to make money through scam e-mails. One tactic that has been around for years and is still relevant plays on people’s fear of computer viruses. Recently, we have received an increasing number of reports about this type of scam. In these cases, however, the scam works not by tricking you with a fake site, but by redirecting you to a legitimate one.

How the scam works

As the target of this kind of scam, you receive an e-mail with an alarming subject line such as 'Virus threat! Do you want to protect your system?' The message may claim that your antivirus subscription has expired, your account has been locked, unauthorised access has been detected, or that your computer is already infected with multiple viruses. In order to pressure you into acting quickly, the scammers may offer a discount on antivirus software if you purchase it immediately, or threaten to block or delete your account if you do not respond.

Clicking the link in the e-mail opens a scam website that runs a fake virus scan and displays bogus results. It makes no difference what operating system you are using and whether your device is actually infected – the scan will always claim that it is. You’re then redirected to the website of a well-known antivirus provider and prompted to buy security software that will remove the supposed viruses. In some cases, the link in the e-mail takes you straight to the legitimate antivirus provider’s site.

E-mail claiming that your antivirus protection has expired.
E-mail claiming that your antivirus protection has expired.
E-mail claiming that access to your account has been restricted because an unknown device attempted to access it.
E-mail claiming that access to your account has been restricted because an unknown device attempted to access it.
E-mail threatening to delete your account.
E-mail threatening to delete your account.

Scammers exploiting commission programmes

The scammers aren’t trying to infect your device with malware. What they’re really after is the commission they earn through antivirus companies’ commission programmes. If you buy legitimate software through the link the scammers provided you with, they get paid. The virus warnings and fake scans are just scare tactics designed to pressure you into buying – so they can pocket the commission.

With this approach, the scammers are deliberately operating in a grey area. Their e-mails may not be fraudulent, but they are clearly designed to mislead you.

Recommendations

  • Antivirus programs are an essential part of protecting your device, but you should only purchase them from the official manufacturer’s website and be wary of suspicious offers.
  • Never click on a link in an e-mail unless you are absolutely sure you know who sent it.
  • Remember that antivirus companies, Microsoft and other software providers do not make unsolicited support calls or send e-mails offering to fix computer problems.
  • Don’t let anyone access your computer remotely. If you’ve already allowed remote access, your device may be compromised. Immediately uninstall the remote access software.

Last modification 20.05.2025

Top of page

https://www.ncsc.admin.ch/content/ncsc/en/home/aktuell/im-fokus/2025/wochenrueckblick_20.html