Scams & FraudBeginner5 min read

The tech support pop-up scam

Your computer is not infected. The screaming pop-up with the toll-free number is the infection.

You're browsing normally when the screen erupts: flashing warnings, a robotic voice announcing your computer is infected and your banking passwords are being stolen, a 'Microsoft' or 'Apple' logo, and a toll-free number to call immediately. None of it is real. It's a webpage — an ad, often on a legitimate site — designed to be terrifying and hard to close. The FBI's fraud data consistently ranks tech support scams among the costliest schemes going, and the victims skew heavily over 60, with losses that routinely reach into life savings.

$900M+
Yearly reported US losses to tech support scams
FBI IC3 estimates; heavily under-reported
~60%
Share of victims over age 60
And they lose the largest amounts by far
$0
What closing the tab costs you
The complete fix for the 'infection'

What's actually happening on your screen

  • The 'virus warning' is a browser page, often served through a malicious ad. Full-screen mode hides your close buttons; looping alert dialogs make it feel unclosable; audio makes it feel urgent.
  • Nothing has scanned your computer. A website cannot detect viruses on your machine.
  • Microsoft, Apple, and Windows Defender never display phone numbers in warnings and never call you. Ever. That's a complete identification rule.
  • The only goal is the phone call — everything after that is social engineering, not technology.

The script after you call

A calm 'certified technician' answers, asks to help, and directs you to install remote-access software. Then comes theater: they open normal system logs (Event Viewer, full of routine yellow warnings on every computer on Earth) as 'proof' of infection, run a fake scan, and deliver the diagnosis. Then the payment: hundreds for a 'cleanup,' more for a 'lifetime security plan.' The devastating variant escalates: they claim your bank accounts are compromised too, transfer you to a fake 'bank fraud department,' and coach you to move your savings to a 'secure account' — sometimes over weeks, sometimes via wire, crypto ATMs, or couriers picking up cash. That's how five-figure and six-figure losses happen.

The pop-up that cost $48,000
A 68-year-old calls the number on a pop-up. The 'technician' ($299 cleanup fee) discovers 'hackers targeting your Chase account' and transfers her to a fake Chase investigator, who explains her money must be 'moved to safety' while they catch the thieves — and sworn to secrecy so the 'insider' at the branch isn't tipped off. Over nine days she wires $48,000 in three installments to accounts the scammers control. The initial pop-up ad likely cost the operation under $5 to place. Nothing was ever wrong with her computer.
Secrecy is the tell
'Don't tell your bank the real reason for the wire.' 'Don't tell your family — the investigation is confidential.' No legitimate institution ever asks you to lie to your own bank or keep a money transfer secret. The moment secrecy enters the conversation, you are the mark in an active scam. Hang up and call someone you trust.

If remote access already happened

Granting remote access isn't game over, but it changes the cleanup. Assume the scammer saw whatever was on screen and may have installed something that survives the call. Disconnect the machine from the internet, then from a different device change your email and banking passwords and enable two-factor authentication. Uninstall any remote tools they had you install (AnyDesk, TeamViewer, UltraViewer, LogMeIn), run a full scan with Windows Defender or a reputable scanner, and if anything banking-related happened during the session, call your bank's fraud line and say the words 'remote access scam' — they have a protocol for it. If you paid for the fake 'cleanup' by card, dispute the charge as fraud; those disputes usually succeed. And expect callbacks for months: the 'refund department' calling later to return your fee is the same crew running the over-refund con on their own customer list.

Closing the pop-up (the whole 'fix')

  1. Don't call, don't click anything inside the page — the buttons are decoration.
  2. Close the browser: on Windows, Ctrl+Alt+Delete → Task Manager → end the browser; on Mac, Cmd+Option+Esc → Force Quit the browser.
  3. If it reopens on relaunch, decline to 'restore tabs,' or restart the computer.
  4. Run a scan with your real, built-in security (Windows Defender or macOS's protections) for peace of mind — it will almost certainly find nothing, because there was nothing.
  5. That's it. The scary infection is cured by closing a tab.

Protect the people who'll get this pop-up next

The best defense is a conversation before it happens, especially with parents and grandparents: real companies never put phone numbers in virus warnings, never call about infections, and never need remote access or payment to 'fix' anything. Install an ad blocker on their browser (malicious ads are the delivery vehicle), set their trusted contact as the first call whenever a screen demands urgent action, and rehearse the line: 'I don't act on pop-ups — I close them.'

Give your family a code phrase for money moves
Agree that no one in the family ever moves money based on a phone call, pop-up, or 'investigator' without first calling one designated person. Scammers manufacture urgency and isolation; a mandatory second opinion, agreed on in calm times, breaks both. It's the cheapest fraud insurance that exists.

The bottom line

The tech support pop-up is pure theater: a webpage pretending to be your operating system, a stranger pretending to be Microsoft, and system logs pretending to be an emergency. Close the tab with Task Manager or Force Quit, never call numbers that appear in warnings, never grant remote access to a cold caller, and teach the script to everyone you love who's over 60. The computer was never broken — the scam only works if you pick up the phone.

Check your understanding

1 of 3
A full-screen warning with a Microsoft logo, a robotic voice, and a toll-free number says your computer is infected and your bank passwords are being stolen. What's actually happening?

Not quite — try again.

The Worth letter

Get smarter about money every week

One email, no spam — practical guides and Worth updates. Unsubscribe anytime.

Put this into practice

Worth tracks your accounts, budgets, and goals — so the concepts in this article aren't just theory.

Start free trial