Key takeaways

A virus alert that appears in your browser and tells you to call a number or buy a tool is a scam. The FTC says real security pop-ups never ask you to call a phone number.

  • Close the browser, or press ALT+F4 on Windows or restart if it will not close, as Microsoft advises. Do not click inside the pop-up.
  • Alerts that keep coming can be notification permissions you gave a site. Block them in your browser’s site settings.
  • If you called and gave access, disconnect, call your bank, remove the software, run a scan, and change passwords from a clean device.

Got a number, site, or product name from the alert? Check the scam directory.

How these scams work

There are two linked tricks. The first is the scareware pop-up: a page that fills your screen with a warning that your device is infected, locked, or hacked. The FTC describes these as fake warnings that look like they come from a well-known company and urge you to call a number. The second is the notification trick: instead of a pop-up window, the site asks permission to send you alerts, and once you click Allow it can keep pushing warnings long after you left.

Microsoft says tech support scam pop-ups may try to block you from closing them and may use alarming sounds or recorded voices. The real goal is a phone call. The FTC says the person who answers will often ask for remote access to your computer, claim to find malware, and offer to remove it for a fee. From there the scam can escalate. The FTC describes a fake technician transferring you to someone posing as a government official, who says your accounts were hacked and asks you to move money to “protect” it.

A third variant skips the pop-up. The FTC describes fake renewal notices for tech support subscriptions, often using the names of well-known brands, which tell you to call within 24 hours. The caller then gets bank or card details through a spoofed page, claims you were overrefunded, and asks you to pay back the “difference”. See subscription and free trial scams for similar renewal tricks.

Three situations, step by step

These are composite scenarios written for this guide, not reports of specific incidents.

The full-screen alert

You open a page from a search result and the screen turns red. A voice says your computer is infected and gives a number. The page will not let you leave. What works: do not touch the page or call. Close the browser. If the mouse does not respond, press ALT+F4 on Windows, as Microsoft advises, and if that fails, restart the computer. When you reopen the browser, do not restore the previous tabs. Then run a scan with the security software you already have, which is also the FTC’s advice if you think there is a real problem.

The alerts that follow you

A week after a visit to a download site, your desktop shows an alert that your device has “3 viruses” even though the browser is minimised. This is a notification, not a scan result. In Chrome, go to Settings, then Privacy and security, then Site Settings, then Notifications, and move the site to Not allowed. Google says you can also open a site’s information and set Notifications to Block. Then check Google’s list of signs of unwanted software: new tabs, changed homepage, redirects.

The renewal email

An email says you were charged for a year of “protection” and you must call within 24 hours to cancel. You did not buy it. Do not call. Open your own bank or card app and look for the charge. If there is no charge, the email is the scam. If there is one, ask your card provider to dispute it, using the number on the card.

Eight warning signs

  1. A virus warning that appears in your browser. Scambaba advice: a web page is not your security software, so treat its “scan results” with suspicion. The FTC describes fake pop-up warnings that look like they come from a well-known company and urge you to call a number.
  2. A phone number to call. The FTC says real security pop-up warnings and messages never ask you to call a phone number. Microsoft says real error messages from big tech companies do not include phone numbers.
  3. A pop-up that will not close, or alarming sounds. Microsoft says tech support scam pop-ups may try to block you from closing them and may use alarming sounds or recorded voices.
  4. A countdown or a demand to act within hours. The FTC describes fake renewal notices that tell you to call within 24 hours. Urgency is the scam’s way of stopping you from checking.
  5. A “subscription renewal” for a product you never bought. The FTC says these messages often use the names of well-known tech brands. Check your bank or card statement before replying. Do not call the number in the message.
  6. Notifications arriving when the browser is closed or the page is not open. Google’s help pages say pop-up-like messages can come from notifications you allowed a site to send. Check your browser’s notification settings.
  7. New tabs, a changed homepage, or redirects. Google lists pop-up ads and new tabs appearing, a homepage or search engine that changes without permission, and redirects to unfamiliar pages as signs of unwanted software.
  8. A request to buy a “cleaner”, install a tool, or pay by gift card. Scamwatch advises buying software only from reputable sources. The FTC says anyone who asks for payment by gift card, wire, or cryptocurrency is a scammer. See remote access software scams.

How to stop pop-ups and notifications in your browser

These steps follow Google’s Chrome help pages and Microsoft’s Edge help page. Other browsers have equivalent settings under their privacy or site permissions menus.

  1. Block pop-ups and redirects in Chrome. Go to Settings, Privacy and security, Site Settings, then Pop-ups and redirects, and choose your default. To block a specific site, find it under Allowed and select Block, or add it under Not allowed. To cover a whole domain, use the pattern [*.]example.com.
  2. Block notifications in Chrome. Go to Settings, Privacy and security, Site Settings, Notifications. Add sites to Not allowed, or turn on “Use quieter messaging” so prompts stop interrupting you. When a site asks for permission, choose Don’t allow.
  3. Block pop-ups in Microsoft Edge. Open Settings, then Privacy, search, and services, then Site permissions, then Pop-ups and redirects, and turn on Blocked (recommended).
  4. Check for unwanted software. Google says to look in your installed apps. On Windows go to Settings, Apps, Installed apps, select anything you do not recognise, and uninstall. On a Mac, open Finder, then Applications, and move unwanted programs to the Trash.
  5. Reset Chrome settings if your homepage or search changed. Go to Settings, Reset settings, Restore settings to their original defaults, Reset settings. After a reset some extensions are turned off. Google advises you to turn back on only extensions you trust, under Extensions, Manage extensions.
  6. Run a scan with your security software. The FTC says to update your security software and run a scan if you suspect a real problem.

If you called the number or paid

These steps follow the FTC’s “what to do if you were scammed” page and Scamwatch’s remote access guidance.

  1. Disconnect. Turn off Wi-Fi or unplug the cable. If someone has remote control, closing their tool and cutting the connection ends the session.
  2. If you paid by card, call the issuer on the number on the back of the card, say the charge is unauthorized or that you were tricked, and ask for a refund. For debit, contact your bank or credit union at once.
  3. If you paid by gift card, wire, cryptocurrency, or a payment app, contact the issuer or provider right away and ask for a reversal. The FTC lists the steps for each. See gift card scams.
  4. If you gave remote access, remove the remote tool, update your security software, run a scan, and delete what it flags. Scamwatch warns scammers may leave a back door. Follow the full plan in remote access software scams.
  5. Change passwords from a clean device, turn on two-factor authentication, and change the password anywhere you reused it. The FTC gives this sequence.
  6. Check statements for tech support charges and for charges you do not recognise. The FTC advises asking your card company or bank to reverse any unauthorized charge.
  7. Report it, using the list below.

Where to report

More help from official sources

Scambaba is an independent educational project. Reporting and recovery options depend on where you live. Items marked as Scambaba advice are practical suggestions, not quotations from an agency. Browser menus change between versions. How these guides are researched is on the editorial policy.

Frequently asked questions

Can a website really detect a virus on my computer?

Treat a web page’s “scan results” with suspicion, because a pop-up is not your installed security software. The FTC says that if you think your computer has a problem, you should update your security software and run a scan, or get help from a company you know or a local computer store, rather than trust a pop-up.

How do I close a pop-up that will not go away?

Microsoft advises closing the browser. If your mouse does not work, press ALT+F4 on Windows. If the browser will not close, restart the computer. Do not click inside the pop-up or call the number it shows.

Why do I keep getting alerts even when no website is open?

Google’s help pages note that pop-up-like messages can come from notifications, which are permissions you gave a site to send you alerts. Review and block them in your browser’s site settings. If alerts continue, check for unwanted extensions or programs, which can also cause pop-ups.

I clicked “Allow” on a notification prompt. What now?

Go to the site’s settings in your browser and set Notifications to Block. In Chrome, open Settings, then Privacy and security, then Site Settings, then Notifications, and move the site to Not allowed. Chrome also blocks notifications from sites it identifies as abusive or misleading, and recommends you keep them blocked.

Is it safe to click the “X” on a scam pop-up?

Not always. Scambaba advice: avoid clicking anything inside the window. Closing the whole browser window or tab from the browser’s own controls is safer than using buttons that the page draws for you.

I called the number and they connected to my computer. What should I do?

Disconnect the device from the internet, call your bank from a different phone, remove the remote access software, run a scan, and change your passwords from a clean device. The FTC and Scamwatch give the same sequence. Our remote access guide has the full step-by-step plan.

Do I need to pay for antivirus at all?

That depends on your device and needs. The point of this guide is narrower: a genuine security product does not announce itself with a scary web pop-up and a phone number. Scamwatch advises keeping antivirus, anti-spyware, and firewall protection up to date and buying software only from reputable sources.