Scammers often impersonate IT departments within large corporations, sending emails with links to "mandatory" security updates, but legitimate IT teams will usually push updates automatically or provide clear instructions through internal portals rather than external email links.