A message claims webmail security patches must be reviewed within 24 hours. The deadline is meant to make a password request feel like routine maintenance.
Opening the real mailbox yourself is safer than following its Review Email Settings button. The destination, not the urgent wording, reveals whether the alert is trustworthy.
Overview
A routine patch notice becomes the bait
Security updates are normal for hosted mailboxes, so the message uses a familiar maintenance story.
The added 24-hour deadline is meant to turn a routine check into a rushed click.
The email says settings must be reviewed to avoid losing access or messages. That language creates urgency without proving that the recipient’s real host sent anything.
The button chooses the sign-in page for you
Review Email Settings sounds like a harmless administration task. In a phishing campaign, the button is the handoff to a page the sender controls.
A real mailbox update can be checked by opening the usual webmail address or hosting panel yourself.
It does not require a surprise email to decide where the password is entered.
Roundcube is software, not proof of the sender
Roundcube is widely used webmail software, which makes its name useful to impersonators. A copied product name cannot verify the domain behind the message or the next page.
The address in the browser and the route used to reach it matter more than the logo or the phrase Admin Support Team.
Those details reveal who actually receives the login.
- The email turns a normal security-maintenance topic into a 24-hour emergency.
- The Review Email Settings button selects an unfamiliar login route.
- A copied Roundcube name cannot verify the sender or destination.
- The real account can be checked from a saved mailbox or hosting bookmark.
How The Scam Works
Step 1: A patches notice lands
The message arrives in the same Outlook or hosted webmail you already trust, with the subject Urgent Action Needed, and with a display name that says Roundcube
Webmail as if a support desk had a queue of security tickets.
There is no long pitch and no attachment you have to open, and the whole card fits on a phone screen on purpose, because a short patches
notice is easier to believe than a letter that asks for a Social Security number in the first line.
If you are already signed in to webmail, the folders on the left and the search bar on the top make the fake note feel native, and
you are not visiting a strange site yet because you are still reading mail.
The letter only has to survive the few seconds between the subject and Review Email Settings, and people who would ignore a lottery note will still open
a patches window that looks like the host they already pay.
Accounts payable lives on that kind of dread, and so does anyone whose job is to keep a mailbox alive through a Monday, because a lost inbox
is a vendor who thinks you went silent.
Mandatory security patches and authentication protocol updates are enough to invent the rest of the afternoon, whether that is a client who will not wait, a payroll
file that should have landed, or a domain the boss will ask about, and the costume only has to last until the button.
Step 2: The name copies Roundcube
Roundcube is not a made-up webmail invented for one inbox, which is the load-bearing detail of the costume, because you do not need a long story when
the letterhead already matches the window you use to read mail.
Roundcube Webmail is the name on the card, and Admin Support Team is the signature under the button, and both lines are doing the same job of
sounding like the mailbox you already pay a host to run.
Those names already live in the muscle memory of people who keep a domain inbox, which is why the costume works in a few seconds, and a
generated-automatically footer plus a 24-hour clock do the rest of that glance.
A real desk would not need that costume, because a real desk already has a panel you can open without a surprise button, and a thief does
need it, because the thief is not inside the product and is not inside your host.
Display names are cheap, and anyone can set From to Roundcube Webmail, which Microsoft’s phishing page treats as a reason to slow down rather than as a
badge you can trust.
The names are there so you will skip the check, and a support desk you already pay does not need a cold patches notice to prove you
own the mailbox it just delivered mail into.
Step 3: Twenty-four hours is the hurry
The body does not threaten arrest or dangle a prize, and instead it tells you that mandatory security patches and authentication protocol updates are rolling out, which
is a quieter hurry than a lockout clock with seconds on it.
Twenty-four hours is the window a busy desk already fears missing, and disruption to email access or potential loss of messages is specific enough to feel like
a real ticket and polite enough to feel like a clerk who already bagged the files.
The line that you should complete the required updates before that clock runs out is the second beat of the same hurry, because required is a word
hosts actually use, and because it turns a maybe later into a now.
Urgency is the point of the 24-hour claim, not evidence of a real patch window that a host would enforce through a button in a cold email.
A real security update, when a host actually has one, is visible inside the panel you already open, and it usually comes with a path you can
walk without proving your password to a stranger.
A fake one cannot wait, because the people who wrote it need you to press Review Email Settings before you read the address bar and before you
notice that the same mailbox just received the warning it claims you might lose.
Step 4: Review Email Settings is the handoff
You click Review Email Settings because that is what a settings link is for, and the click is the moment the patches costume can drop.
The next page is not a settings screen with toggles you can print, and it is not a log of authentication protocol updates you can match against last week’s mail.
It is a door to a page the letter already picked, and there is no honest reason for a security review to live on a surprise site
you reached from an unexpected email.
You are already sitting inside the mailbox that supposedly needed those patches, which is the contradiction the button hopes you will not sit with.
A real review would open inside the webmail you already use, or it would sit as a banner on the panel your host already gave you, and
it would not ask you to prove you are you so a 24-hour clock can finish.
It would not need a fresh login to show you settings on a box that just received this letter.
CISA tells people not to follow a link in a message that then asks for that kind of information, and Review Email Settings is the detour from
a letter you trust to a page you should not finish.
The button is written as a panel you can open, and what it actually does is hand you off to a page the letter already chose.
Step 5: The page copies webmail
When the destination loads, the screen is built to look like the webmail you already use, with a username field and a password field and a Login
control, which is a useful stage set because a familiar window feels like a system talking rather than like a stranger asking for a key.
Your address may already be sitting in the username field, pre-filled from the message, the link, or the bulk list that received the same notice, so the
errand feels half finished before you type anything.
The overlay will say the patches cannot finish until you sign in, or that the authentication protocol update cannot apply until you verify the account, which is
a polite way of asking for the same password you used to open Outlook.
Padlock icons and HTTPS do not establish that the page belongs to the host it imitates, because they only mean the connection to that particular page is encrypted.
Your address sitting in the box can feel like recognition even though the address was taken from the letter you just read.
Do not finish that form to see whether the patches then apply, because a copied login does not become safer when you only wanted a 24-hour window to close.
Those pages move, and a copied live address is how the next person in the office gets hurt, so a screenshot with the link unclicked is enough
if you need a second pair of eyes.
Step 6: They want the mailbox password
If you type the password they have the first key, and if a text, an authenticator prompt, or an email code arrives while that copied webmail page
is still open they want the second key too.
The story will sound helpful, asking you to confirm so the security patches can finish, or to approve so the authentication protocol update can apply.
It may also ask you to enter a code to verify your work account, and each line is the same request for access to the mailbox you
were already sitting in.
The Urgent Action Needed notice was never sitting behind that box, because the mailbox was, and the people who wrote the letter designed the 24-hour clock so
you would not notice the swap.
Microsoft’s phishing page tells you to change the password on every affected account if you think you typed it on the wrong site, and to turn on
multifactor authentication if it is not already on, which is the same advice the FTC gives in consumer language.
Treat the password as burned and treat the code as burned, and do not reuse either one on the next page that promises to unlock a patches window.
You should not type the same password into the host, the bank, or payroll as a courtesy refresh, because a copied webmail form does not get to
supervise those other accounts either.
Change those passwords on sites you open yourself, one at a time, after the fake tab is gone, because a copied login does not get to supervise the cleanup.
Once they can open the account they are not hunting for a settings page that sat behind a 24-hour clock, because they are reading the last invoice
you sent and the last invoice you received.
They also read the thread with a vendor who pays by wire, and then they write the next message in your voice, which is how a patches
notice becomes a payment problem.
A bill that looks like last month’s bill is enough, and a new-account, same-firm line is enough, and if they add a forwarding rule they can keep
a copy after you change the password until someone deletes the rule.
A compromised mailbox is not a nuisance in that setting, because it is a way to move a payment without ever calling you again, which is why
a patches notice that asked for a password was never about a security update.
Step 7: A second crew sells recovery
The last move is often social, and it may not even be the same people, because a day later you can get a call, a text, or
a fresh email that already knows you opened an Urgent Action Needed notice.
They will offer to finish the security patches, apply the authentication protocol update, or recover the messages you never lost, and then they will ask for a
code, a remote-access session, a second password, or a cleanup fee.
Hang up, because a stranger who found you is not your incident responder, and a Roundcube desk that called you after Review Email Settings is not the
product whose name was printed on the card.
That is why a quiet admission that you already clicked, even if you did not pay anyone, is not the end of the story, because you may
not have paid while the person who trusts you might.
Tell the people who send you money and the people you pay, and tell a real coworker, if you actually share the mailbox, on a number you
already have rather than on a number that arrived after Review Email Settings.
A 30-second call from you is cheaper than a week of wires that look like your week, and the second crew is counting on shame to keep
you quiet long enough for the first crew’s mail to land.
Company, Address, and Fulfillment Checks
Roundcube does not operate every mailbox that uses its software
Many providers and organizations run Roundcube on their own domains. A generic Roundcube-branded email cannot identify which host, administrator, or account system supposedly requires action.
The recipient should begin with the normal webmail bookmark or hosting provider dashboard, not with the sender name or button inside the alert.
The sender address must match the established mailbox service
A display name such as Admin Support Team can be selected by anyone.
Compare the full sender and reply-to addresses with messages the real provider has sent in the past.
A mismatched domain is enough to stop. It does not become safe because the email includes a familiar webmail product name or a formal footer.
A real support desk can be reached independently
Use a saved support number, an existing provider portal, or a contact record from the hosting account.
Do not reply to the phishing email or use its contact details to verify it.
If the update is genuine, the real host can confirm it through that independent route. If it is false, the same check helps protect other mailbox users.
Fulfillment means a visible setting in the authentic account
A genuine security change appears after the user signs in through the real service.
It does not require the recipient to disclose a password, recovery code, or approval prompt to a newly opened page.
The moment an unexpected page asks for a mailbox password, stop. The purpose has changed from viewing settings to collecting credentials.
What to Do if You Have Fallen Victim to This Scam
If you only opened the email and closed it without following Review Email Settings, you are not finished with the message, but you are not looking at
a device infection from reading alone.
If you pressed Review Email Settings and then typed a password, a code, or personal information, treat the account as touched and move in this order, because
speed matters more than naming the exact kit they used.
The goal is to take the mailbox back before someone else sends the next invoice or patches notice in your name.
- Save a screenshot of the email and note whether you entered a password, recovery code, or other detail. The real provider can use that information to contain the incident.
- Open your real mail yourself in a new tab you type, then change the password to one you have not used anywhere else. Use the official site or the app you already trust, and do not return to the patches notice for a reset link. If this is a Microsoft account, follow Microsoft’s steps to recover a hacked or compromised Microsoft account. If you cannot sign in, use the official reset path, not a link from the patches notice, and if this is Gmail or a workplace portal, open that product the same way from an address you typed.
- Sign out of other sessions everywhere you can, then turn multifactor authentication back on before you do anything else with the mailbox. Review recent activity and sign out of sessions you did not start, then confirm the extra lock is on, preferably with an authenticator app, a passkey, or a security key rather than a text message alone. If you approved a prompt you did not start, assume that session is not yours until you kill it, and remove recovery phones and recovery addresses you did not add. A password change that leaves an old session running is only half a change, and if you reused that password on banking, payroll, or the hosting panel, change those on their own sites after you type those sites yourself.
- Look for inbox rules, automatic forwarding, and mail that left without you, because those are the quiet ways a stolen mailbox keeps working after a password change. Check the Sent folder and look for a new mailbox delegate, a new app that can read mail, or a filter that hides replies. Delete what you did not create, search for other Urgent Action Needed or Review Email Settings notes you did not expect, and if this is a work account, call IT before you spend an hour hunting, because they can dump sessions and pull the audit faster than you can. Also look at Deleted, Junk, and custom folders, because an attacker who is already inside often hides the security alerts that would have told you they were there.
- Protect every account that shares the inbox, starting with banking, cloud storage, shopping, social media, payroll, and the hosting panel that sends reset mail to the same address. Replace reused passwords while you revoke suspicious sessions on those sites too, after you type those sites yourself rather than following anything in the notice. If personal, financial, or identity information went into the copied webmail page, contact the relevant bank or provider directly using a number from a statement or a card in the drawer, not a number that appeared after Review Email Settings. United States victims can use IdentityTheft.gov to build a recovery plan based on the information that was stolen, which is more useful than waiting to see whether a vendor already paid on a fake invoice.
- Tell the people who might get the next copy of this letter, including contacts who already received messages from your account this week. Warn them not to open unexpected patches or Review Email Settings links that appeared to come from you, and tell them to call you on a number they already have. If you handle invoices, payroll, or vendor payments at work, tell your administrator the same day, because a hijacked mailbox can change payment instructions in a thread that already looks like yours. A 30-second call on a number you already have is cheaper than a week of wires that look like your week, and shame is the delay the second shift is counting on.
- Report the email through the controls your mail product already publishes, then scan the device if Review Email Settings saved a file or pushed a viewer. In Outlook, use Report and then Report phishing, the path Microsoft publishes on its phishing help page, and in Gmail use Google’s reporting control from the same phishing help page they publish for this. Forward a copy to the Anti-Phishing Working Group at reportphishing@apwg.org, file at the FTC’s ReportFraud site, and send a cyber report to the FBI’s IC3 if money or identity data moved. If the button saved a file or pushed a viewer, run a full scan with Malwarebytes or the antivirus you already keep updated, knowing that the scan does not get a password back and the password change does that.
- Use AdGuard while securing the mailbox to reduce accidental clicks on future phishing links. It cannot validate a Roundcube settings request.
If someone forwarded you the notice, send them this page instead of the Review Email Settings button, because these patches cards travel in office threads when they
look like host mail.
Do not install a new cleaner you just searched for because a follow-up email recommended it, and do not approve a remote-access session for a person who
already knows the subject line and offers to finish the update.
A stranger who found you after Urgent Action Needed is not your incident responder, and a recovery desk that called you after a copied webmail login is
not the product whose name was printed on the blue bar.
If you actually keep mail on a host that uses Roundcube, treat this letter as a reminder to open that product from a bookmark you already keep,
not from mail, and look at the real inbox and the real status page.
If the panel shows no mandatory security patches waiting on a 24-hour clock, then no such clock is waiting, and if a real update did sit in
the host panel, it will still be sitting there without a password typed into a stranger’s form.
A fake patches notice does not become real because you were waiting on a security update, and waiting is the opening they wrote the subject for.
Frequently Asked Questions
Is Roundcube itself unsafe?
No. Roundcube is legitimate webmail software used by many providers. This scam abuses the product name to make an unrelated email and credential page look familiar.
Can a real webmail provider send a security update?
Yes. The safe response is to open the provider’s own site separately and check the account there, rather than following a surprise button from the email.
What if I clicked but did not enter anything?
Close the page and report the email. A click alone is less serious than submitting credentials, but the link may still be used for tracking or further redirection.
Why does the fake page look like webmail?
Phishing pages copy familiar layouts because recognition lowers caution. The browser address and the route to the page matter more than its design.
Should I change my password after entering it?
Yes. Change it from the genuine mail provider, end unknown sessions, inspect recovery options, and check forwarding rules or filters for unauthorized changes.
Can a password manager help?
Often, yes. A password manager may refuse to autofill on a lookalike domain, giving the user a useful warning before credentials are submitted.
The Bottom Line
A note that says Urgent Action Needed, arrives as Roundcube Webmail, and writes as Admin Support Team is a login hunt wearing a 24-hour patches window.
It claims mandatory security patches and authentication protocol updates require you to review account settings, warns that access or messages may be lost if you wait, and
offers Review Email Settings as if those updates were waiting behind a single button.
The webmail whose name was borrowed is real, and it is not the sender of this mail, and it does not ask you to sign in on
a copied form from an unsolicited inbox notice just to finish a security update.
Review Email Settings is how they get you onto that form, the copied webmail page is how they collect the password, and the mailbox is what they
use next, including the contacts, the reset codes, and the vendor threads that already trust your name.
Open the mail service you already pay by typing it yourself if you need to know whether anything is wrong with the account, and open the host
panel the same way if you need to know whether a real patch window is in progress.
If you already typed the password, change it on the provider’s own page, kill the other sessions, inspect forwarding rules, and tell the people who send you
money before the next email goes out as you.
The patches were only costume for a password harvest, and Review Email Settings was how they asked you to hand the inbox over.
