The tech support pop-up scam
Your computer is not infected. The screaming pop-up with the toll-free number is the infection.
You're browsing normally when the screen erupts: flashing warnings, a robotic voice announcing your computer is infected and your banking passwords are being stolen, a 'Microsoft' or 'Apple' logo, and a toll-free number to call immediately. None of it is real. It's a webpage — an ad, often on a legitimate site — designed to be terrifying and hard to close. The FBI's fraud data consistently ranks tech support scams among the costliest schemes going, and the victims skew heavily over 60, with losses that routinely reach into life savings.
What's actually happening on your screen
- The 'virus warning' is a browser page, often served through a malicious ad. Full-screen mode hides your close buttons; looping alert dialogs make it feel unclosable; audio makes it feel urgent.
- Nothing has scanned your computer. A website cannot detect viruses on your machine.
- Microsoft, Apple, and Windows Defender never display phone numbers in warnings and never call you. Ever. That's a complete identification rule.
- The only goal is the phone call — everything after that is social engineering, not technology.
The script after you call
A calm 'certified technician' answers, asks to help, and directs you to install remote-access software. Then comes theater: they open normal system logs (Event Viewer, full of routine yellow warnings on every computer on Earth) as 'proof' of infection, run a fake scan, and deliver the diagnosis. Then the payment: hundreds for a 'cleanup,' more for a 'lifetime security plan.' The devastating variant escalates: they claim your bank accounts are compromised too, transfer you to a fake 'bank fraud department,' and coach you to move your savings to a 'secure account' — sometimes over weeks, sometimes via wire, crypto ATMs, or couriers picking up cash. That's how five-figure and six-figure losses happen.
If remote access already happened
Granting remote access isn't game over, but it changes the cleanup. Assume the scammer saw whatever was on screen and may have installed something that survives the call. Disconnect the machine from the internet, then from a different device change your email and banking passwords and enable two-factor authentication. Uninstall any remote tools they had you install (AnyDesk, TeamViewer, UltraViewer, LogMeIn), run a full scan with Windows Defender or a reputable scanner, and if anything banking-related happened during the session, call your bank's fraud line and say the words 'remote access scam' — they have a protocol for it. If you paid for the fake 'cleanup' by card, dispute the charge as fraud; those disputes usually succeed. And expect callbacks for months: the 'refund department' calling later to return your fee is the same crew running the over-refund con on their own customer list.
Closing the pop-up (the whole 'fix')
- Don't call, don't click anything inside the page — the buttons are decoration.
- Close the browser: on Windows, Ctrl+Alt+Delete → Task Manager → end the browser; on Mac, Cmd+Option+Esc → Force Quit the browser.
- If it reopens on relaunch, decline to 'restore tabs,' or restart the computer.
- Run a scan with your real, built-in security (Windows Defender or macOS's protections) for peace of mind — it will almost certainly find nothing, because there was nothing.
- That's it. The scary infection is cured by closing a tab.
Protect the people who'll get this pop-up next
The best defense is a conversation before it happens, especially with parents and grandparents: real companies never put phone numbers in virus warnings, never call about infections, and never need remote access or payment to 'fix' anything. Install an ad blocker on their browser (malicious ads are the delivery vehicle), set their trusted contact as the first call whenever a screen demands urgent action, and rehearse the line: 'I don't act on pop-ups — I close them.'
The bottom line
The tech support pop-up is pure theater: a webpage pretending to be your operating system, a stranger pretending to be Microsoft, and system logs pretending to be an emergency. Close the tab with Task Manager or Force Quit, never call numbers that appear in warnings, never grant remote access to a cold caller, and teach the script to everyone you love who's over 60. The computer was never broken — the scam only works if you pick up the phone.
Check your understanding
1 of 3Not quite — try again.
Get smarter about money every week
One email, no spam — practical guides and Worth updates. Unsubscribe anytime.
Put this into practice
Worth tracks your accounts, budgets, and goals — so the concepts in this article aren't just theory.
Start free trial