In this guide 10 sections
At a glance
The short version.
Watch for
- A browser pop-up that displays a support number and prevents ordinary navigation
- An unexpected call claiming a known company detected a problem on the device
- A subscription-renewal notice that demands a phone call within hours
Already acted?
Disconnect the affected device from the internet and end the remote session.
See every recovery stepWhat is changing now
The current pattern.
Official guidance describes two recurring entry points: a false security warning that claims a device is infected, and a fake subscription-renewal or refund message. Both can lead to remote-access software, staged banking screens, gift-card or crypto payments, and instructions to hide the activity from family or bank staff.
How it works
How the scam unfolds.
A browser page, advertisement, call, email or text claims that a trusted technology company detected a virus, charge or account problem. The warning is designed to make the displayed number feel like the only safe route, even though a website cannot reliably diagnose a device through a dramatic pop-up.
Once connected, the caller asks the user to install remote-control software or visit a support page. They may open normal system tools and misrepresent harmless entries as evidence of compromise. With screen access, they can observe credentials, alter what appears in a browser or persuade the user to sign in to banking.
Refund variants create a fake overpayment on screen and ask the victim to return the difference. The supposed refund exists only in the display the scammer controls. Payment is then requested by transfer, gift card, cryptocurrency, cash collection or another method that is difficult to reverse.
Warning signs
Reasons to stop and verify.
- A browser pop-up that displays a support number and prevents ordinary navigation
- An unexpected call claiming a known company detected a problem on the device
- A subscription-renewal notice that demands a phone call within hours
- A request to install screen-sharing or remote-control software
- Instructions to open banking, move money or hide the reason for a payment
- Gift cards, cryptocurrency, wire transfer or cash requested for support or a refund
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
Full-screen warning while browsing
WARNING: YOUR COMPUTER HAS BEEN BLOCKED1 (warning sign 1)
Suspicious activity detected. Your banking passwords and photos may be stolen.2 (warning sign 2)
Do not close this window or restart your computer.3 (warning sign 3)
Call Support immediately: +1 (202) 555-01394 (warning sign 4) (toll free)
Error code 0x80070 · Session ID 44-A915 (warning sign 5)
- An alarming headline
Huge warnings, flashing colours and alarm sounds are designed to cause panic. Real security software does not ask you to phone a number shown on a web page.
- Personal fears
Mentioning banking passwords and private photos makes the threat feel personal and urgent.
- An instruction not to close it
Closing the tab or browser is exactly what you should do. The page wants you to believe that would be dangerous.
- A phone number on screen
Genuine technology companies do not put support numbers in pop-up warnings. Calling connects you to the scammer.
- Technical-looking codes
Error codes and session IDs add authority but mean nothing here. They exist to make the page look official.
Close the tab or browser — force it to quit if necessary — and run your usual security software. If you are still worried, contact support through the company’s own website or device settings.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
A renewal email turns into a refund emergency
- 01The opening
An email says an expensive antivirus subscription renewed today and provides a number for cancellation. The recipient does not recognise the purchase and calls quickly to stop the charge.
- 02The escalation
The agent asks to connect to the computer to process a refund, opens online banking and claims to have returned ten times too much. They instruct the customer to repay the difference immediately and not mention the error to bank staff.
- 03The decision point
The message created the problem and supplied the only route to fix it. Remote access, a bank login, an alleged overpayment and secrecy are separate control tactics that all benefit the caller.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Check whether the claimed event exists
Use the real software account, app-store subscription list or bank statement. Do not rely on an invoice image or balance shown during a remote session.
- 02
Find support from a clean route
Use help built into the device or software, or type the vendor’s official domain. Avoid numbers in pop-ups, unsolicited messages and paid search advertisements.
- 03
Refuse remote control for an unsolicited problem
A company that contacts you unexpectedly has not earned device access. End the conversation before installing anything or sharing the screen.
- 04
Verify money on a separate device
If a caller claims money moved, sign in from another trusted device or call the bank. Do not let the remote operator interpret the balance for you.
Prevention
Make the next attempt harder.
- 01
Keep devices and browsers updated
Automatic updates close many of the security gaps that fake warnings pretend to fix, and make genuine problems less likely.
- 02
Know your real security software
Learn what your built-in or installed security tool looks like and where its alerts appear, so a web page imitating it looks out of place.
- 03
Bookmark real support routes
Save the support pages for your device, software and internet provider. Searching for a number during a crisis can lead to fake support adverts.
- 04
Agree a family remote-access rule
Relatives who help each other with technology can agree that nobody installs remote-access software for a caller they did not contact first.
If you already acted
Protect access and contact the real provider.
- Disconnect the affected device from the internet and end the remote session.
- From another trusted device, contact the bank and secure email, financial and other important accounts.
- Remove the remote-access tool, update the device and run a full security scan before sensitive use.
- Review account sessions, forwarding rules, recovery details, payees and transactions for changes.
- Preserve the message, phone number, payment records and software name, then report the incident locally.
Common questions
Short answers to real doubts.
The pop-up will not close. What should I do?
Close the browser completely. On Windows, press Ctrl+Shift+Esc to open Task Manager and end the browser; on a Mac, press Command+Option+Esc and force-quit it. When you reopen the browser, do not restore the previous session.
Does a real technology company ever call about a virus on my computer?
Major technology companies do not make unsolicited calls, texts or emails to say your device is infected. If you did not start the contact, treat it as a scam and hang up. You can check your device yourself with its built-in security tools.
I let them connect remotely. Is my computer still compromised?
It may be. Disconnect it from the internet, remove any remote-access programs that were installed, run a full security scan and change important passwords from a different device. If you are unsure what changed, ask a trusted technician before using the computer for banking.
Remote-access recovery stepsSources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.