Tech Support Pop-up Scam

What is it?

You are browsing the internet when suddenly your screen is hijacked by a flashing red warning box. A loud alarm sound might play, and a robotic voice announces that your computer has been infected with a dangerous virus. It tells you that your bank details are being stolen and you must call “Microsoft” or “Apple Support” at the 1-800 number on the screen immediately to save your computer.

How it works (The Teardown)

1. The Trap: You accidentally click a bad link, misspell a website name, or click on a malicious advertisement. This redirects your web browser to the scammer’s website.
2. The Illusion: The scammer’s website is programmed to go “full screen,” hiding your normal computer taskbar. It displays fake, scary virus warnings.
3. The Lock: The website uses a trick to prevent you from closing the tab. Every time you try to click the ‘X’, another warning pops up, making you feel like the computer is truly broken.
4. The Call: Panicked, you call the 1-800 number. The person who answers claims to be from Microsoft or Apple. They tell you they need to remote into your computer to “fix” the virus.
5. The Theft: Once they are remotely connected to your computer, they will ask you to log into your bank account to “verify your funds are safe.” While you do this, they steal your money.

How to identify this scam

• Real companies do not use pop-ups with phone numbers: Microsoft, Apple, and Google will never display a warning message on your screen with a phone number to call.
• High pressure: The message is designed to create absolute panic (flashing red lights, blaring alarms) so you don’t stop to think logically.

How to avoid it

• Do not call the number: Understand that there is absolutely nothing wrong with your computer. It is not infected. You are simply looking at a malicious webpage that is pretending to be a virus scanner.
• Use an ad-blocker: Using a trusted ad-blocker like uBlock Origin prevents the malicious advertisements that lead to these fake warning screens from loading in the first place.

What to do if you are affected

1. If you just saw the pop-up: Do not call the number. Simply restart your computer. If you can’t click the restart button because it is hidden, press and hold the physical power button on your computer for 10 seconds until it forces a shutdown. When you turn it back on, the pop-up will be gone.
2. If you called and let them connect:
   • Immediately unplug your computer from the internet (or turn off your Wi-Fi router).
   • Use your phone to call your bank immediately and freeze your accounts, as the scammers likely accessed them.
   • Take your computer to a professional local repair shop (like Best Buy Geek Squad) and tell them you allowed a scammer to remote in. They will need to wipe the machine to ensure no hidden software was left behind.