Broadband Provider Filters and Malware Alerts

If your broadband provider tells you a device on your home network has malware, take it seriously and act on it. Malware, short for malicious software, is code that can harm your computers and laptops and the data on them: it can steal your data, encrypt it so you cannot access it, or even erase it completely¹. A provider can sometimes spot the telltale network traffic of an infected device because all your internet traffic passes through its equipment, and a warning from that direction is worth acting on.

The first thing to know is that a genuine alert is a starting point, not a verdict. It tells you something on your network is behaving like it is infected. Your job is to find out which device, clean it up, and then make sure it cannot happen again. The National Cyber Security Centre (NCSC) advises that for PCs and laptops you should make sure you have antivirus and install security updates as soon as they are available, ideally by setting them to install automatically².

The second thing to know is that criminals imitate these alerts. Fake "security warnings" are a common scam format, because a frightened reader clicks first and thinks later. This page covers both sides: what to do when the alert is real, and how to check whether it is real before you act on it.

What to do when your broadband provider sends a malware alert

Work through these steps in order. They follow official NCSC guidance on dealing with infected devices².

1. Check the alert is genuine before acting on it. Do not click links in the message itself. Sign in to your provider's account page or app directly, or call the number on your bill. Scammers know provider security warnings exist and copy them.
2. Identify the likely device. Think about what has changed recently: a new app installed, a suspicious text with a delivery link, an email attachment opened, or a USB stick from someone else. Devices become infected if you accidentally download malware from an attachment in a dubious email, by visiting an infected website, or by using an infected USB stick¹.
3. Run a full antivirus scan. The NCSC's phishing guidance is direct: open your antivirus software if you have it, run a full scan, and allow it to clean up any problems it finds³.
4. Stop the spread if you are worried. If you think more than one device might be affected, NCSC guidance written for WannaCry victims applies: immediately disconnect your computer, laptop or tablet from the network and turn off your WiFi⁴.
5. Change passwords. If you logged into any accounts or apps since the malware was installed, you must change the password for that account, and update the same password on any other accounts where you used it, making sure each one is unique⁵.
6. Check the job is done. NCSC ransomware guidance says to monitor network traffic and run antivirus scans to identify if any infection remains⁶.
7. Harden the device afterwards. After fixing the infection, follow NCSC advice on setting up your devices securely: check the device is encrypted, and for PCs and laptops make sure you have antivirus and install security updates as soon as they are available, ideally automatically⁷.

One point worth understanding: the malware that triggers provider alerts is often a "banking trojan". The NCSC explains that victims are tricked into unwittingly installing malware that secretly monitors their online activity and steals passwords and other personal details, which can then be used to commit online crime including financial crime⁸. The most notorious of these is called FluBot, spread by fake "missed parcel" text messages⁵. This kind of malware also tries to access your contact list and send scam SMS messages to those numbers as well, helping it spread⁸. That is why step 5, changing passwords, matters even if the device now seems fine.

If the infection turns out to be ransomware, which locks or encrypts your files and demands payment, do not assume paying solves it. NCSC guidance is blunt: if you pay the ransom, your computer will still be infected⁶. Our page on ransomware covers that situation in full, and our after infection checklist lists what to check once the device is clean.

How to tell a real alert from a scam

This is the part most people arrive wanting, and the warning signs are consistent across every type of scam message the NCSC describes. Look out for official-sounding messages about "resetting passwords", "receiving compensation", "scanning devices" or "missed deliveries"; emails full of "tech speak"; and being urged to act immediately or within a limited timeframe⁹. Those last two together, technical language plus urgency, are the signature of a scam.

The links in these messages are the trap. Scam messages typically contain links to websites that look genuine but store your real details once typed in, install viruses, or steal passwords you enter⁹. A fake provider security alert works exactly this way: it frightens you with talk of infections, then offers a "scan" or "fix" link that installs the very malware it claims to remove.

Specific scams to know about, all documented in official guidance:

The NHS vaccination phishing emails described by Ofcom show how convincing these can be: checking the sender shows where such messages have really come from, and the advice is not to click on any links in them¹⁴. The same check applies to anything claiming to be from your broadband provider.

After a real data breach, the danger doubles, because criminals know you are expecting messages about it. NCSC guidance says to be alert to suspicious messages, which may be sent some time after the breach is made public¹³, and that you should always be alert to approaches from anyone claiming to have your data, and to suspicious calls or emails asking for personal or financial data¹⁵. NHS advice issued after the Synnovis cyber incident gives the same instruction: send suspicious emails to report@phishing.gov.uk or texts to 7726¹⁶. Our page on scam messages after a data breach goes through this in detail.

What a network filter does, and where it stops

A network-level filter or security service from your broadband provider works on the connection itself, at the provider's equipment, rather than on any individual device. That gives it one clear strength and one clear limit. The strength: every device on your home WiFi benefits, including things that cannot run their own protection. The limit: it sees traffic, not devices. It can block known bad websites and flag suspicious behaviour, but it cannot update your software, fix your passwords, or clean an infected machine. Those jobs stay with you.

That division of labour matters when you act on an alert. The provider's warning is the network side doing its job. The cleanup is your side, and official guidance is consistent about what it involves:

• Antivirus on every PC and laptop. The NCSC says it is really important that you always use antivirus software, and keep it up to date, to protect your data and devices¹. If you switch on the built-in antivirus, you'll instantly be safer¹. Windows has a built-in malware protection tool, Microsoft Defender, which the NCSC says is suitable for this purpose⁴.
• Software updates, installed promptly. Ensure your device is kept up to date by installing the latest software and patches⁸. Setting them to install automatically is the approach the NCSC recommends².
• A secured home WiFi network. ProtectUK, the police counter-terrorism security advice service, advises you to check the security protection of your home and business WiFi networks and change the default manufacturer passcode¹⁷.
• Strong, unique passwords with two-step verification. The NCSC advises switching on two-step verification (2SV) on important accounts, so a criminal who knows the primary password still cannot get in¹⁸.
• Backups, kept separate. The NCSC says to disconnect removable media when it isn't in use, because viruses and other malware such as ransomware can move to attached media automatically and infect the backup¹⁹.

For phones and tablets the picture differs by system. On Android devices, make sure Google's Play Protect service is enabled; some Huawei devices provide a similar tool to scan devices for viruses⁵. Our pages on antivirus and antivirus on phones cover the choices, and software updates explains why updates do most of the preventive work.

Smart home devices and others that cannot protect themselves

Smart speakers, cameras, baby monitors, televisions and other connected gadgets are the devices most dependent on whatever protection sits on the network, because most of them cannot run antivirus software at all. A provider's network-level filter is one of the few protections that reaches them. That is a genuine benefit, but it does not transfer the responsibility: the maker's updates and your choice of settings still decide how secure each device is.

The practical steps for smart devices come from the same official guidance as everything else on this page. Keep each device's software updated, because outdated software is how malware gets in⁸. Change any default passcode the device shipped with, following the ProtectUK advice on default credentials¹⁷. Be cautious when using third-party applications, because malicious codes known as malware can spread rapidly around social networks or via email¹⁷. If a device acts strangely, treat it as you would a laptop: disconnect it from the network and check for updates from the maker.

Our page on smart speakers, cameras and baby monitors covers this device by device, including how to check what a device is sending out and what to do with kit that no longer receives updates.

Email spam filters and reporting

Your email provider's spam filter catches much of the malicious mail before you see it, and your broadband provider may filter email and other traffic too. But filtering is a net, not a wall. The NCSC's scam guidance exists precisely because scam messages get through, and its reporting service exists because reporting works: it is free to report a suspicious email and it only takes a minute, and reporting reduces the scam emails you receive, makes you a harder target and protects others from cyber crime¹⁰.

The reporting routes to remember:

• Suspicious emails: forward them to the NCSC's suspicious email reporting service. Do not click on any links in a suspicious email first¹⁰.
• Suspicious text messages: forward them to 7726, a free service for reporting spam¹².
• Suspicious websites with malware: you can report these directly to the NCSC⁸.

Reporting a scam text or email takes seconds and costs nothing, and it is the one action that helps everyone else on the same network. Our narrow guides on reporting a phishing email and reporting a scam text walk through each route.

What malware costs when it gets through

The stakes behind these alerts are real, and the official record shows what infection can cost even well-resourced organisations. Gloucester City Council faced costs of around £800,000 after its systems were infected by malware from a Russian threat actor, causing delays to benefits payments, property sales and planning applications²⁰. A parliamentary committee reported that in 2021 the volume of ransom payments quadrupled²⁰. The NCSC's 2022 Annual Review noted that it continued to see increased use of Ransomware as a Service, where ransomware variants are leased to less-skilled affiliates who can launch cyber attacks without building the ransomware themselves, and that it is increasingly seeing data extortion as a fundamental part of the ransomware business model²¹.

For a household, the same mechanics apply in miniature. A banking trojan steals passwords and can drain accounts⁸; ransomware locks files and demands payment that leaves the machine still infected⁶. The NCSC also operates a free Early Warning service for organisations, which monitors multiple sources and delivers notifications about possible system compromise, malicious activity and vulnerabilities²⁰: a reminder that network-level monitoring and warning is a recognised security model, and your provider's alert to you is the household-scale version of it.

The free protections that blunt all of this are the ones already listed: built-in antivirus switched on¹, updates installed automatically², unique passwords with 2SV¹⁸, and backups disconnected when not in use¹⁹. None of them costs money. Our home online security checklist puts them in one place.

If your provider offers no filter, or you need extra help

Not every broadband provider offers network-level security or filtering, and the level of service varies between them. If yours does not, the protections on your own devices carry the whole load, and they are the ones official guidance treats as essential anyway: antivirus, updates, strong unique passwords, 2SV and backups¹. Check your provider's website or account page for what is included, and if you are unsure, ask.

If you are a vulnerable customer, for example elderly or with additional needs, Ofcom expects your phone and broadband provider to provide extra support, and you can ask to be registered for it²². Providers hold lists of customers who need priority treatment, and being on one means you are contacted proactively when there are problems with your service. Ofcom's advice on staying connected also applies if you depend on your landline for a care alarm or similar device: tell your provider in advance, so they can check whether your device will work and make any necessary arrangements²³.

Finally, government emergency alerts are a separate system from anything your provider sends: they are broadcast to compatible mobile phones and tablets and do not come from your broadband provider. Your mobile phone or tablet does not have to be connected to mobile data or wifi to get alerts²⁴, and if you get an email claiming to be about one, it could be a phishing attempt or a scam, so report anything you think is suspicious²⁵. It is possible to opt out of the emergency alerts system if you need your phone to stay concealed, for example if you are a domestic abuse victim²⁶.