The fake security popup

Listen to this page This recording is of an earlier version of this page.Also in: English · Español · Tiếng Việt · 中文 · Русский · 한국어

What it looks like

You're reading the news or looking something up. Suddenly the screen fills with a warning. Maybe a siren sound. Maybe a robotic voice.

⚠ YOUR COMPUTER HAS BEEN BLOCKED Windows Defender. Trojan detected Your banking information is at risk. Do not shut down your computer. Call Microsoft Support: 1-888-XXX-XXXX

The mouse may seem stuck. The window may not close. It may go full screen and refuse to leave.

Already paid someone who called about this, or let them into your computer? Call your bank or card company first, on the number on your card, and ask them to stop or reverse the charge. The full recovery checklist is here.

What's actually happening

Nothing is wrong with your computer.

You clicked a bad ad, often on an ordinary, legitimate website, because ad space is sold and resold and scammers buy it. The "warning" is just a web page designed to look like a system alert. It's a picture of an emergency, not an emergency.

Your computer has no virus. Nothing is being stolen. The only threat on your screen is the phone number.

Microsoft does not put phone numbers in error messages. Neither does Apple. Neither does any real security program. No operating system has ever asked you to call anybody. That single fact ends this scam permanently once you know it.

The same scam, the other way around

Sometimes there's no popup at all. The phone just rings, and it's "Microsoft" or "your antivirus company," saying they've detected a problem on your computer and need remote access to fix it.

Tech support never calls to tell you there's a problem.

Not Microsoft. Not Apple. Not any antivirus company. None of them call you out of the blue about your computer, which means a call like this is the scam itself, not a warning about one. Hang up. If you want to check, look up the company's number yourself and call them, the same as everything else on this site.

The newer one: a "prove you're human" box that asks you to type

This one doesn't ask you to call anybody, which is why it gets past people who know the old version.

A page shows what looks like the usual "verify you're human" check. Instead of clicking a box or picking traffic lights, it gives you steps to follow: hold down the Windows key and press R, then press Ctrl and V, then press Enter. On a Mac it's a Terminal window and a line to paste.

What you can't see is that the page has already put a command on your clipboard. Those keystrokes open a box that runs commands, paste the command in, and run it. In seconds it installs malicious software, and from then on somebody else may be able to use your machine while you're asleep.

The FBI, CISA and Health and Human Services described this trick in a joint advisory in July 2025: a ransomware group's fake check that tells people to open the Windows Run window, paste, and run a hidden command. It's been used on hacked ordinary websites, not just sketchy ones, so arriving from a link you trusted proves nothing.

A real "are you human" check never asks you to type anything into your computer. Clicking a box, picking pictures, dragging a slider: those are real. Keyboard shortcuts, a paste, a Terminal window: those are the scam, every time, without exception.

If you've already done it, treat it exactly like letting somebody in by phone: disconnect from the internet, and follow I let someone into my computer.

What happens if you call

A polite, professional person answers, often with a queue and hold music. They ask you to install a program so they can "look at" your machine. AnyDesk, TeamViewer, LogMeIn, UltraViewer. Real tools, used for real support, being used against you here.

Then they show you something alarming: the Event Viewer full of red "errors" (every Windows computer on earth has hundreds; they're routine), or a command window scrolling text. It looks devastating. It's theater.

Then comes the bill. Often a few hundred dollars for "removal," or a multi-year "security plan." And now they have remote access to your computer, your files, your saved passwords, and often your bank login.

Sometimes it goes further. They "refund" you too much money (a fake screen showing $20,000 instead of $200) and beg you to send back the difference, crying that they'll lose their job. That's how a $400 scam becomes a $19,600 one. Nothing was ever sent to you. The number on your screen was typed by them.

Often it doesn't end there either. This is frequently the opening act of the Phantom Hacker scheme, where the "tech" hands you off to a fake bank, who hands you off to a fake government official.

What to do right now

If the popup is on your screen and you haven't called:

Don't call the number.
Close the browser. If it won't close: press Ctrl + Alt + Delete on Windows and pick Task Manager. On a Mac, press Command + Option + Escape. Then force the browser to quit.
If that fails, hold the power button until the computer shuts off. This is safe. The warning telling you not to shut down is lying, that instruction exists only to keep you scared and on the screen.
When it restarts, don't reopen the previous tabs.
That's it. You're done. Nothing is infected.

If you already called and let them in: Go to I let someone into my computer and do those steps in order.

How to never fall for it again

Say this out loud once and it'll stick:

A real virus does not give you a phone number.

Real security software cleans things quietly in the background. It doesn't scream at you, doesn't play sirens, doesn't demand a call. Anything that does is advertising, and in this case, advertising a crime.

You handled it

If you closed that window without calling, you just beat a scam that took more than a billion dollars from Americans over 60 in 2025, by the FBI's count. That wasn't luck. That was you knowing one fact that they were counting on you not knowing.

Tell somebody about it. The next person who sees that screen will be glad you did.