Is that virus warning real? How to spot a fake pop-up and what to do

How a fake warning actually works

These pop-ups aren't viruses on your computer. They're web pages built to look like a system alert. They switch the browser to full screen so you can't see the tabs or the close button, play a loud alarm or a recorded voice, and sometimes freeze the mouse so it feels like the whole computer is locked. The goal is to get you to call the number, where a "technician" talks you into installing remote access software and paying for a fake repair.

Here's how to tell fake from real:

• Fake: a phone number to call, "Microsoft Windows Defender Alert," "Apple Security Center," an FBI or police seal, a countdown timer, a voice or alarm, a full-screen page inside Chrome, Edge, Safari or Firefox.
• Real: a small notification in the corner of the screen from Windows Security (or your installed antivirus), no phone number, and it opens the Windows Security app, not a website.

Close it without calling

1. Don't click anything on the page, including "OK," "Close" or "Cancel." On these pages, every button just triggers more pop-ups or a download.
2. Press the Esc key or F11. That often exits full screen and shows the normal browser window, so you can close the tab.
3. Force the browser closed. On Windows, press Ctrl, Shift and Esc together to open Task Manager, select Chrome or Edge, and click "End task." On a Mac, press Command, Option and Esc together, choose the browser and click "Force Quit."
4. If the computer truly won't respond, hold the power button for 10 seconds. It's safe and won't damage anything.
5. When you reopen the browser, don't restore your tabs. Chrome and Edge offer to "Restore pages." Say no, or the scam page opens again.

If you already called or let them in

You're not alone, and acting in the next hour matters more than anything else. Here's what I do on these visits, in order:

1. Disconnect from the internet. Turn off WiFi on the computer or unplug the network cable. That ends their live connection.
2. Call your bank or card company using the number on the back of your card if you paid anything or showed them your banking. Say "tech support scam." They can often stop or reverse a card charge. Gift cards and wire transfers are much harder to recover, so call right away.
3. Remove the remote access programs. Scammers usually install AnyDesk, TeamViewer, UltraViewer, ScreenConnect or similar tools so they can come back later. On Windows, check Settings, then Apps, then Installed apps, and uninstall any you didn't install yourself. Some also abuse Windows' built-in Quick Assist, which is fine to keep but should never be used with someone who called you.
4. Change passwords from a different device, starting with your email, then banking. Turn on two-step verification for both.
5. Check your email for rules. Scammers sometimes add a forwarding rule or a filter so they keep getting copies of your mail, including bank alerts. In Gmail, look under Settings, then Forwarding. In Outlook, check Rules.
6. Watch for the "refund" call. A few days or weeks later, someone calls saying you're owed a refund and "accidentally" sends too much, then asks you to send the difference back. It's the same scammers.

When to call for help

If you called the number, someone connected to your computer, or the pop-ups keep coming back, I'll come to your home, remove the remote access software and anything else they installed, check your browser and email for changes they made, and lock down your accounts. There's no judgment. These scams are designed to fool smart, careful people. See virus removal and scam cleanup. For phone and text scams, read scam calls and texts targeting seniors.

Common questions