Fake Virus Warning Popups: How Tech Support Scams Really Work

It arrives without warning, usually after a mistyped address or a click on an ad. The screen fills. There is a siren, or a robotic voice repeating that your computer has been locked. Red text warns that your banking credentials are being transmitted, that Windows Defender has detected a trojan, that you must not restart your computer. A phone number is displayed prominently, described as Microsoft Support, and the page will not close.

Almost everything on that screen is false, and one thing in particular is worth internalizing before anything else: a website cannot scan your computer. The security model of every modern browser exists specifically to prevent a page from reading your files, enumerating your processes, or inspecting your system. The scan you are watching is an animation written in advance. It shows the same "infections" to every visitor, and it plays identically on a brand-new machine that has never been online.

The alarming design has a single purpose, and it is not to inform you. It is to move you off the screen and onto the telephone, where a person can talk you into granting access to your machine. Everything harmful in this scam happens on that call.

Why the popup seems impossible to close

People often conclude their computer really is locked, because the page genuinely does resist closing. That impression comes from a handful of ordinary web techniques, none of which involve any access to your system.

• Fullscreen mode is requested by the page, which hides the browser toolbar and the close button so the window looks like a system-level takeover.
• A dialog loop repeatedly triggers alert boxes, so dismissing one immediately spawns another and the page appears frozen.
• A navigation guard fires a "Are you sure you want to leave?" prompt on every attempt to close.
• The cursor is hidden or replaced, or the page captures the pointer so clicks do not land where you expect.
• Audio autoplays a siren or a synthesized voice, which is the single most effective element for producing panic.
• The page is styled as a pixel-accurate copy of a Windows or macOS system dialog, including the correct fonts and iconography.

What happens if you call the number

The person who answers is a call centre operator following a script refined across thousands of calls. They will sound calm, technically fluent and genuinely helpful, and they will spend the first minutes building credibility rather than asking for anything. Then they will ask to connect to your computer to "run diagnostics" — using legitimate remote access software such as AnyDesk, TeamViewer or LogMeIn, which is exactly why the download looks safe and passes antivirus.

Once connected, a standard sequence follows. They open Windows Event Viewer and present routine warning entries — present on every healthy computer — as evidence of infection. They may run netstat and describe normal network connections as intruders, or open a command prompt and type alarming text directly into it. The performance is designed to convert your uncertainty into their authority.

The payment request follows, typically several hundred dollars for a multi-year "support plan". But the more serious exposure is the access itself: while connected, they can install persistent remote tools, harvest saved browser passwords, read your email, and open your online banking with your own logged-in session.

Where these popups come from

They rarely mean your computer is compromised. The common delivery routes are mundane: a malicious advertisement served through a legitimate ad network, a typo in a domain name, a redirect from a free streaming or download site, an aggressive browser notification you accidentally allowed, or a browser extension gone bad.

That last one is worth checking if the popups keep returning. Site notification permissions, once granted, can push alerts that appear even when the browser is closed. Reviewing the notification permissions in your browser settings and revoking anything unfamiliar resolves most recurring cases.

If you already gave someone access

One reframing helps more than any checklist. Every genuine security tool on your computer is already running with the access it needs to protect you — it does not require your cooperation, and it certainly does not need you to phone anyone. So the moment an alert needs you to take an action outside the software itself, especially a phone call, you are not looking at a security product. You are looking at an advertisement that has been designed to frighten you, and the correct response is to close the window.

Editorial note: This guide is general consumer education, not legal or financial advice. Dispute deadlines, liability limits and reimbursement policies vary by institution and change over time. Confirm your specific rights with your bank or a qualified professional. See our editorial policy for how we research and review this content.