The fake virus pop-up scam: what to do next
You were browsing normally, and then the screen locked up. A loud alarm sound, maybe, and a full-screen message in red text saying your computer is infected, your files are being stolen right now, and you need to call a support number immediately. The number looks official. Maybe it even says Microsoft or Apple at the top. It is not. It is a fake alert designed by someone who wants your money or your computer, not a real security warning.
If you already called the number, or worse, let someone remote into your machine or paid for “support,” you are probably feeling foolish right now. You are not. These pop-ups are built by people who test them against thousands of people until they know exactly which words cause panic. The alarm sound, the countdown timer, the warning that you'll lose your files if you close the tab, none of that is an accident. It is designed to make you skip the step where you would normally stop and think.
Real security software does not work this way
No legitimate operating system or antivirus program locks your browser and demands you call a phone number. Microsoft, Apple, and real antivirus vendors do not put their support number in a pop-up that appears while you are reading a webpage. If a page will not let you close it, close the whole browser instead. On a phone or computer that fully freezes, a restart usually clears it, since most of these are just a webpage designed to look like a system crash, not an actual infection.
If you called the number
Hang up if you are still on the call. Simply calling does not compromise anything by itself, the danger is in what happens after: being talked into installing software, reading out a one-time code, or handing over payment details. If none of that happened, you are likely fine. Still worth restarting your device and running a scan with your device's built-in security tool (Windows Security on a PC, or a reputable antivirus you installed yourself, never one the caller told you to download).
If you let them remote into your computer
This is the part that matters most. Once someone has remote access, they can see your files, your saved passwords, and anything open in your browser. Disconnect the computer from the internet first, then get help removing the remote access tool, either from someone you trust or a computer shop you chose yourself. From a different, clean device, change the passwords for your email, banking, and any account that shares a password with something the scammer may have seen. Turn on two-factor authentication where you can. Our guide on what to do after giving a scammer remote access walks through this in more detail.
If you paid for the “support”
Contact your bank or card issuer and tell them it was an unauthorized or fraudulent charge, since these often qualify for a dispute. If you paid with a gift card, call the number on the back of the card right away and ask them to freeze it, then keep the card and receipt. Payment method matters here: a card charge has real dispute options, a gift card or wire transfer usually does not, but reporting still helps others and can occasionally still recover funds if you move fast.
Report it, even if nothing was lost
File a report at ReportFraud.ftc.gov and, if money changed hands, at IC3.gov as well. Include the phone number you were told to call, the website where the pop-up appeared, and screenshots if you managed to take any before closing it. These reports feed into the patterns investigators and platforms use to get fake support numbers and scam pages taken down, even when your individual case can't be pursued on its own.
How to avoid it next time
Bookmark the real support pages for the software and devices you use, and only ever call numbers from those pages, never one shown to you in a pop-up. Keep your browser and operating system updated, since a lot of these pop-ups arrive through outdated ad software or a sketchy download rather than any real vulnerability. And if a page ever tells you something terrible will happen if you don't act in the next sixty seconds, treat that urgency itself as the warning sign. Real security problems do not put a countdown timer on the screen.
You didn't do anything careless by browsing the internet and hitting a bad pop-up. What matters now is the next few steps, and you've already read them.
— Gus