How to Tell If a Windows 11 Update Is Real or Fake

“Your Windows 11 update is required” pops up while you’re browsing, and your gut says something’s wrong. You’re right to be suspicious: Microsoft doesn’t deliver routine OS updates that way, and a wave of fake update sites has been tricking people into installing password-stealing malware instead.

What Is Windows Update (and Windows Security)?

Windows Update is the built-in Microsoft service that installs OS patches, security fixes, and feature updates. It lives inside Settings > Windows Update. For most day-to-day updating it doesn’t appear in a browser, though Microsoft’s own documentation notes that Windows Update or Microsoft Update can open in a browser in certain legacy or manual-download scenarios. Windows Security (which runs Microsoft Defender) is a separate app that keeps your malware-detection data current and lets you scan for threats. Think of it as your backup checkpoint if a fake update ever slips past you.

Before You Begin

Make sure you have:

• A Windows 11 PC with administrator access
• A few minutes to check Settings and the Windows Security app
• Any suspicious file or link you’ve already clicked, ready to reference (don’t run it)
• A password manager or list of your important account logins, in case you need to change them

Requirement	Details
Device	Windows 11 PC or laptop
OS version	Windows 11, any currently supported version (25H2, 26H1)
Account	Local admin or Microsoft account with admin rights
Software	Windows Security (built in, no install needed)

How Real Windows 11 Updates Are Delivered

For typical consumer updating, Microsoft doesn’t push an OS update through an email attachment or a random file downloaded from an unfamiliar site — it directs you to the built-in Windows Update mechanism instead. Microsoft does offer official .msi/.exe update installers through channels like the Microsoft Update Catalog and its support site, but those are for specific, verified scenarios, not something you should click from an arbitrary website or email. Here’s the typical legitimate path an update takes.

• Click Start, then select Settings (or press Windows key + I).
• Select Windows Update in the left sidebar.
• Click Check for updates. If anything is available, Windows downloads and installs it here directly, without needing a browser.

• To confirm what’s actually been installed, select Update history from the same page.

• For a quick version check, go to Settings > System > About and look at the Windows specifications section for your Version and OS Build.

• Or type winver into the Start menu search box and press Enter for an instant popup with the same information.

If a page, email, or pop-up is pressuring you to update anywhere other than this menu, treat it as suspicious.

The April 2026 Fake Update Campaign: A Real-World Example

In April 2026, researchers at Malwarebytes documented a scam site built to look like an official Microsoft support page. It used a domain name that was one letter off from a real Microsoft URL, a technique called typosquatting. Visitors landed on the page after searching for Windows support terms or clicking a malicious ad, and were shown an urgent-looking message claiming their PC needed a critical Windows 11 update. Clicking through prompted a download of a file disguised as an installer. Running it silently deployed infostealer malware designed to harvest saved browser passwords and account credentials.

Nothing about that page came from Microsoft. Once you know what to look for, the giveaway is usually clear: legitimate day-to-day Windows updates come through Settings, not through an urgent browser pop-up pushing you to download and run a file from an unfamiliar site. A similar scam ran earlier that year, spreading fake Windows 11 downloads through Facebook ads targeting people searching for free upgrades.

Red Flags That Reveal a Fake Windows Update

Watch for these together. Scam pages usually stack several at once.

• A downloaded .msi or .exe file claiming to be a Windows update from an unfamiliar site or ad. For everyday updating, Windows installs itself through Settings rather than through a file you download and double-click; treat unsolicited installers as suspicious, even though Microsoft does offer official .msi/.exe update files through verified channels like the Microsoft Update Catalog.
• Urgency language like “critical,” “act now,” or a countdown timer. Microsoft doesn’t pressure you with deadlines inside a browser pop-up.
• Requests for a phone number or payment. Windows Update is free and never asks you to call anyone or enter a credit card.
• A domain that isn’t microsoft.com. Check the address bar carefully; typosquatted domains often swap a single letter or add an extra word.
• A full-screen browser page that mimics a system dialog. Typical Windows update screens live inside the Settings app; treat a full-screen browser pop-up posing as an update dialog as a red flag.

How to Verify a Suspicious Update Prompt Before You Act

If you see something that looks like an update warning while browsing, don’t click anything on the page.

• Press Ctrl + Alt + Del and select Task Manager (or press Ctrl + Shift + Esc directly).
• Find your browser in the process list and select it.

• Click End task to close the page without interacting with it further.
• Open Settings > Windows Update and click Check for updates to see your PC’s real status.
• Compare what you see against Update history. If Windows shows nothing pending and your recent updates match what you’d expect, the pop-up was fake.
• Confirm your build number with winver or Settings > System > About if you want a second confirmation.

If Windows Update genuinely has something waiting, it’ll be listed right there. No browser detour required.

What to Do If You Already Ran a Fake Update File

If you downloaded and ran a file before realizing it wasn’t legitimate, don’t panic. Work through these fixes in order.

Fix #1: Change Your Passwords Right Away

• Use a different, trusted device (like your phone) to log in to your important accounts: email, banking, and any password manager.
• Change each password, starting with your email account since it can be used to reset everything else.
• Turn on two-factor authentication wherever it’s available.

Fix #2: Run a Full Microsoft Defender Scan

• Open Windows Security from the Start menu.
• Select Virus & threat protection.

• Under Protection updates, confirm Defender’s security intelligence is current, then click Check for updates if it isn’t.

• Go back to Virus & threat protection, select Scan options, choose Full scan, and click Scan now. This checks every file on your PC, including ones that aren’t currently running.

Fix #3: Check Protection History for What Defender Caught

• In Windows Security, select Virus & threat protection > Protection history.

• Review any entries related to the file you ran. This tells you whether Defender quarantined it or whether it executed before detection.

Fix #4: Monitor Your Accounts for Suspicious Activity

• Check your email account’s recent sign-in activity for logins you don’t recognize.
• Check bank and credit card statements for unfamiliar charges over the next few weeks.
• Consider a credit freeze if you entered any financial details on the fake page.

Fix #5: Reinstall Windows If Something Still Feels Off

• If Defender keeps flagging new threats, apps behave erratically, or passwords keep getting reset without your action, back up your personal files.
• Go to Settings > System > Recovery and use Reset this PC to reinstall Windows cleanly. This is the most invasive option; reserve it for cases where scanning and password changes don’t resolve the problem.

How to Report a Scam Windows Update Site

Reporting the site helps get it taken down before it catches someone else.

• Report phishing and tech-support scam pages directly to Microsoft through the Microsoft Report a Technical Support Scam page.
• In Microsoft Edge, use Settings and more > Help and feedback > Report unsafe site while the page is open (or report it from memory using the URL if you already closed it).
• If you’re in the US, file a report with the FTC at reportfraud.ftc.gov or the IC3 at ic3.gov.
• If you entered payment information, report the transaction to your bank or card issuer immediately.

Tips and Troubleshooting

“You’re up to date” but I expected a new feature. Microsoft rolls out features gradually, and some releases only reach specific hardware first. This is normal, not a sign anything’s wrong. Confirm your exact build with winver.

I’m confused about “OS updates” vs. “Defender updates.” They’re two separate systems. OS updates live in Settings > Windows Update. Defender’s malware-detection data (formerly called “definitions”) lives in Windows Security > Virus & threat protection > Protection updates.

I clicked the pop-up but didn’t download anything. Simply viewing or closing a scam page without downloading a file or granting remote access usually doesn’t compromise your PC, per Microsoft’s own guidance. Still worth running a Defender scan for your own peace of mind.

Wrapping Up

Checking Settings > Windows Update takes 30 seconds, and it’s where a real Windows 11 update will typically show up. Treat urgent update prompts outside that menu as suspicious until proven otherwise.

If you already ran a suspicious file, changing your passwords and running a full Defender scan handles most of these incidents. Save the reinstall option for the rare case where problems keep coming back after that.

Step	Action	Applies To
1	Check Settings > Windows Update for real updates	Everyone
2	Close suspicious pop-ups via Task Manager	Anyone who sees a fake prompt
3	Verify with winver and Update history	Anyone unsure if an update is legit
4	Change passwords and run a full Defender scan	Anyone who ran a suspicious file
5	Report the site to Microsoft or the FTC	Anyone who encountered a scam page

Resources

• Windows Update FAQ (Microsoft)
• Is this update screen fake or legit? (Microsoft Q&A)
• Virus & threat protection in the Windows Security app
• This fake Windows support website delivers password-stealing malware (Malwarebytes, April 2026)
• Windows 11 release information (Microsoft Learn)