← Is This A Scam?

Fake Virus Pop-Ups and Tech Support Scams

Last reviewed

A page suddenly fills your screen, maybe with an alarm sound, saying your computer is infected or locked and that you must call Microsoft or Apple support immediately. It's a web page, not a warning from your computer. Here's how to close it, and what to do if you already called.

These pop-ups are designed to look like they come from your operating system. They copy the Windows or Apple logos, show a fake virus scan counting up infections, and sometimes play a recorded voice. Some go full screen and seem impossible to close. All of that is ordinary web page code running inside your browser.

The only part that matters is the phone number. The pop-up can't steal anything by itself. It exists to get you on a call with someone who will then ask for access to your computer and, eventually, money.

What one of these looks like

The wording varies, but it's usually close to this:

WINDOWS SECURITY ALERT: Your computer has been blocked. Error code #0x268d3. Trojan spyware detected. Your personal data and banking details are at risk. Do not close this window. Call Microsoft Support immediately: +1 (800) 000-0000

The error code looks technical and means nothing. "Do not close this window" is there because closing it is exactly what fixes the problem.

Red flags to look for

How to close it

  1. 1Don't call the number and don't click anything inside the pop-up, including buttons that say "Cancel" or "Close". They may just open more pages.
  2. 2Try pressing Esc, or F11 on Windows, to leave full screen, then close the tab.
  3. 3If the browser won't respond on Windows, press Ctrl+Shift+Esc to open Task Manager, select the browser and click End task. On a Mac, press Command+Option+Esc, choose the browser and click Force Quit. On a phone or tablet, close the tab or swipe the browser app away.
  4. 4When you reopen the browser, decline any offer to restore the previous session or tabs, or the page will load again.
  5. 5If warnings keep appearing as notifications, open your browser's settings, find site permissions for notifications, and remove any site you don't recognise.

What happens if you call

Whoever answers will sound like a technician. They usually ask you to install a remote-access program, which are legitimate tools with names like AnyDesk or TeamViewer, so they can "run a diagnosis". Once connected, they can see and control your screen. They point at normal system logs or settings and describe them as evidence of hackers, then offer to fix it for a fee, a "security subscription", or a payment in gift cards or crypto.

A common next step is the refund trick: they claim to refund you, "accidentally" send too much, and ask you to send the difference back. The same script appears in fake Amazon order calls and PayPal invoice scams. The "extra" money was moved between your own accounts, or edited on your screen.

What Microsoft and Apple actually do

Microsoft says it doesn't send unsolicited messages or make unsolicited calls to offer technical support or ask for personal or financial information, and that its error and warning messages never include phone numbers. Apple tells people not to call numbers in pop-ups and not to give remote access to anyone who contacts them unexpectedly. Neither company will ask you to pay with gift cards.

If you want to check your computer, use the security software already built in: Windows Security on Windows, or keep macOS up to date on a Mac. If you need real support, start from microsoft.com or apple.com, typed into the browser yourself, or visit a store or repair shop you chose yourself.

Got a warning or support message you're not sure about?

Paste it into the free checker and see the specific red flags in it. No signup, no email.

Check a message

If you already called or let them in

  1. 1Hang up and disconnect the computer from the internet: turn off Wi-Fi or unplug the network cable. That ends any remote session.
  2. 2Uninstall any program they asked you to install. If you aren't sure what was installed, or they set up a password on your computer, have it checked by a repair shop you choose yourself.
  3. 3Call your bank on the number on the back of your card. Tell them someone had remote access to your computer, ask them to stop or recall any payment made during the call, and dispute charges you don't recognise.
  4. 4If you paid with gift cards, contact the gift card company straight away through the number on the card or its official website. Keep the cards and receipts.
  5. 5From a different device, change your passwords, starting with email and banking, and turn on two-step verification.
  6. 6Report it to the FTC at reportfraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov. You can also report tech support scams that used Microsoft's name to Microsoft through its website.
  7. 7Expect follow-up calls. Scammers often call back later offering a refund for the "service", or claiming to be a recovery agency. Both are part of the same scam.

If you shared personal details as well as money, how to report a scam lays out the full order of steps.

Common questions

Is my computer actually infected if I saw one of these pop-ups?
Almost certainly not. The pop-up is a web page, usually reached through a bad ad, a mistyped address or a redirect, and it can't scan your computer. Closing the browser ends it. If you didn't download or install anything and didn't let anyone connect to your computer, there's normally nothing else to clean up.
Do Microsoft or Apple warnings ever include a phone number?
No. Microsoft says its genuine error and warning messages never include phone numbers, and that it doesn't make unsolicited calls offering tech support. Apple likewise tells people not to call numbers shown in pop-ups. A warning that tells you to phone someone is the scam.
The pop-up won't close and my browser is frozen. What do I do?
On Windows, press Ctrl+Shift+Esc to open Task Manager, select your browser and choose End task. On a Mac, press Command+Option+Esc, choose the browser and click Force Quit. When you reopen the browser, don't restore the previous tabs. Restarting the computer also works.
I let them connect to my computer. What should I do first?
Disconnect from the internet, then uninstall the remote-access program they had you install. Call your bank on the number on your card, especially if you signed in to banking while they were connected. From a different device, change your email and banking passwords. Then report it at reportfraud.ftc.gov and ic3.gov.

This page is informational and we aren't affiliated with any company or agency named on it. We can't tell you whether your specific message is genuine. Verify independently: open the company's official app or type their website address yourself, and call the number printed on your card, statement, or the back of your ID — never a number supplied by the message.

Want simple scam alerts for your family?

Join the early-access list. This is an idea we're testing, not an active protection service — nothing is monitored today, and joining changes nothing about your accounts.