Tech Support Pop-Up Scams: How to Spot and Stop Fake Security Warnings

What to Do Right Now

If a sudden warning, error message, or flashing screen has appeared on your computer or phone, follow these immediate containment steps:

• Do not call the phone number displayed on the screen. Genuine security alerts from companies like Microsoft and Apple will never ask you to call a phone number (FTC, Microsoft Support).
• Do not click any links or buttons on the pop-up, even if they say "Cancel," "Close," or "Verify Now."
• Close your browser. If your browser is locked or looping, force it to close:
  • On Windows: Open the Task Manager to terminate the browser process (Microsoft Security Blog).
• Do not allow remote access. If you are already on the phone with someone, hang up immediately. Never download software or run scripts at the request of an unsolicited caller (FBI IC3).

How Tech Support Pop-Up Scams Work

Tech support scams rely on psychological pressure. Scammers use technical tricks to make you believe your computer or phone has been compromised, hoping you will panic and call their fraudulent hotlines (FTC).

The Desktop Pop-Up

While browsing the web, you might be redirected to a malicious site that triggers a full-screen alert. These pages often mimic official Windows system screens, complete with fake error codes, warning sirens, or automated voice messages warning that your credit card details and personal files are being stolen (Microsoft Security Blog). Some variants use "dialogue loops" that continuously reopen the alert, making it appear as though your browser is completely locked (Microsoft Security Blog).

The Mobile Apple Pay Trap

Scammers have also adapted these tactics for mobile devices. In an independent analysis by Malwarebytes, researchers identified a mobile-specific scam that displays a fake Apple Pay processing screen for a $657 transaction (Malwarebytes). The page uses the browser's built-in text-to-speech API to read aloud a warning that your Apple ID is locked, urging you to call a fake support number (Malwarebytes). Despite the realistic visual cues, the entire transaction is hardcoded and completely fake (Malwarebytes).

The "Phantom Hacker" Escalation

If you call the number, the scam often escalates into what the FBI calls a "Phantom Hacker" scheme (FBI IC3):

1. Phase 1 (The Tech): The scammer gains remote access to your device, pretends to run a scan, and claims your financial accounts are compromised (FBI IC3).
2. Phase 2 (The Bank): You receive a call from a co-conspirator posing as your bank's fraud department, instructing you to move your money to a "safe" government account (FBI IC3).
3. Phase 3 (The Government): A third scammer, pretending to be from the Federal Reserve or another federal agency, demands you wire funds, buy gold, or purchase cryptocurrency to "protect" your assets (FBI IC3, FTC).

Spotting the Red Flags

To protect yourself, look for these unmistakable signs of a tech support scam:

What to Do If You Already Engaged

If you realized too late that you were dealing with a scammer, take these containment steps immediately based on what occurred:

If You Gave Remote Access

• Uninstall any software the scammer had you download (Microsoft Support).
• Run a full security scan using your device's built-in security software (like Windows Security) to detect and remove any installed malware (Microsoft Support).
• If the device remains unstable or fake alerts persist, consider performing a full system reset (Microsoft Support).

If You Shared Passwords

• Change your passwords immediately (FTC).
• If you reuse that password on other accounts (such as email, banking, or social media), change those passwords as well and ensure two-factor authentication is enabled (FTC, Apple Support).

If You Paid or Shared Financial Info

• Contact your bank or credit card company immediately to report the fraudulent transaction, dispute the charges, and request new cards (Microsoft Support).
• If you sent money via wire transfer, gift cards, or cryptocurrency, contact the respective service provider immediately to see if the transaction can be stopped, though recovery is often highly challenging (FBI).

Protecting Yourself and Older Relatives

According to the FTC, consumers aged 60 and older are five times more likely to report losing money to a tech support scam than younger individuals (FTC). Scammers target older adults because they often have accumulated savings and may be more trusting of authority figures (FBI).

Share these simple rules with your family to build a strong defense:

• The "No-Call" Rule: Never call a phone number that appears in a browser pop-up or error message (Microsoft Support).
• Verify Independently: If you receive an email or text about a subscription renewal (such as Geek Squad or Norton), do not use the contact details in the message. Look up the company's official customer service number independently (FTC).
• Government Agencies Never Demand Money: No legitimate government representative will ever tell you to transfer funds to a "federal safety locker," buy gold, or use cryptocurrency to protect your assets (FTC, FBI IC3).

Quick Answers

Do Microsoft or Apple ever include phone numbers in error messages?

No. Genuine error and warning messages from Microsoft and Apple never include phone numbers for you to call (Microsoft Support, Microsoft Support). Any pop-up that displays a phone number is a scam.

What should I do if my browser is locked by a flashing warning?

Do not click anything on the page. Force-close your browser using Task Manager on Windows (Microsoft Security Blog).

Where should I report tech support scams?

You should report tech support scams to the Federal Trade Commission at ReportFraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov (FTC, FBI IC3).