What's going on
You click a link, visit a website, or tap on an advert, and your screen is suddenly filled with a warning that looks like it came from Windows, Apple, or Google. The message says your computer is infected with a virus, your personal data is at risk, and you must call a phone number right now or your files will be deleted. Some of these popups play alarm sounds. Others lock your browser so you cannot close the tab. A few will make your mouse cursor vanish so you think your computer has frozen.
None of it is real. The warning is a webpage, not a system alert. Your computer is fine. The only danger is what happens if you ring that number. Action Fraud reported that more than 20,000 people fell victim to remote access scams in a single year, losing a combined total of over £57 million (Action Fraud). The fake virus popup is one of the most common ways these scams begin. The FCA recorded an 86% increase in screen sharing scam cases in the year to March 2022 alone (FCA ScamSmart Campaign).
What these popups look like
They all follow the same formula. A scary warning, an official looking logo, and a phone number. Here are the versions that come up again and again.
"Windows Defender" alert
The most common version. A blue or red screen mimicking the Windows Defender interface. It claims trojans have been detected and your personal data is being stolen. A phone number flashes in bold text. The page title changes to something like "Microsoft Support" to make the browser tab look official.
"Windows Defender Security Warning: Trojan spyware detected. Your passwords, banking details and personal files are at risk. Do not shut down your computer. Call Microsoft Support immediately: 0808 XXX XXXX."
"Google Security Alert" popup
This one appears while you are using Chrome and looks like it came from Google. It says your device has been compromised and that suspicious activity has been detected. It often plays a robotic voice through your speakers warning you not to close the browser.
"GOOGLE SECURITY ALERT: Your device has been compromised. Personal data breach detected. Contact Google Certified Technicians immediately on 020 XXXX XXXX to prevent identity theft."
"Apple Security" warning
Mac users are not immune. This variant mimics Apple's look and feel and claims that macOS has detected malware. It targets people who believe Macs cannot get viruses, counting on the shock of seeing a warning they never expected.
"Apple Security Warning: Your Mac is infected with 3 viruses. Your system files will be deleted in 0:03:42. Call Apple Support now on 0800 XXX XXXX to protect your computer."
"Browser locked" screen
The nastiest version. Your entire browser goes full screen and the popup keeps reappearing every time you try to close it. Some show a fake countdown timer claiming your files will be destroyed. Others display a fake "Blue Screen of Death" that sits on top of everything so you think your PC has crashed.
"YOUR BROWSER HAS BEEN LOCKED. All PC data will be detained and criminal proceedings will be initiated against you if you close this window. Call toll free: 0808 XXX XXXX."
How the scam works
The popup is just the beginning. The real scam starts when you pick up the phone. Here is what happens from that point.
1. You land on a dodgy page
It usually starts with a mistyped web address, a misleading advert, or a compromised website that redirects you. Sometimes you click on a search result that looked legitimate. The page loads what appears to be a system alert, but it is just a website made to look like one. These pages are cheap to set up and criminals create thousands of them. When one gets taken down, another goes up within hours.
Why it looks so real
The page uses the same fonts, colours, and logos as Windows or macOS. It opens in full screen mode so you cannot see the browser address bar. JavaScript prevents you from closing the tab by spawning new popups every time you click. The alarm sound triggers your fight or flight response. Your brain reads it as a genuine emergency before you have time to think clearly.
2. You call the number
Someone answers sounding calm and professional. They say they are from Microsoft, Windows Support, or Apple Support. They ask you to describe what is on your screen and confirm the "error code" shown in the popup. This makes it feel like a real support call. They already know what the popup says because they built it. Once they have your trust, they ask you to download remote access software so they can "fix" the problem.
The tools they use
They will ask you to install TeamViewer, AnyDesk, or UltraViewer. These are real, legitimate programs used by IT departments everywhere. The problem is not the software. It is what the criminal does once they are connected. A Which? survey found that 4 in 10 people had never heard of remote access software, which makes it easy for scammers to present these tools as a normal part of getting tech support.
3. They get inside your computer
Once they are connected, they open the Windows Event Viewer or Terminal and point at normal system logs, telling you these are evidence of a virus. None of them are. Every Windows PC has thousands of harmless event log entries. But if you do not know that, it is terrifying. They may also run a fake scan that conveniently finds dozens of "threats" on your machine. The whole performance is designed to convince you that your computer is in serious trouble and only they can save it.
What they are really doing
While they show you fake problems, they are looking through your files, checking saved passwords in your browser, and noting down personal details. Some install hidden software that lets them reconnect after the call ends. Others will ask you to log in to your online banking to "check whether the virus has affected your accounts." Once they can see your banking screen, they transfer your money.
4. They take your money
The money grab takes one of two forms. The simplest version is that they charge you for the "repair." They ask for your card details or tell you to make a bank transfer for anything from £149 to £499 for a "lifetime security package" that does not exist. The second version is worse. They transfer money directly out of your bank account while connected, sometimes blacking out your screen so you cannot see it happening. If they cannot get into your bank directly, they may try the overpayment trick: editing your banking page to make it look like they have accidentally deposited thousands of pounds, then begging you to send the "extra" back by bank transfer. UK Finance reported total fraud losses of £1.28 billion in 2025, with phone based scams accounting for 17% of all APP fraud cases but 28% of the total money lost.
How to close a fake virus popup
These popups are built to make you think you cannot close them. You can. Here is how, depending on what you are using.
Windows PC
- 1. Press Ctrl + Shift + Esc to open Task Manager
- 2. Find your browser in the list (Chrome, Edge, or Firefox)
- 3. Select it and click "End task"
- 4. When your browser asks to restore pages, say no
- 5. Clear your browsing data to stop the popup coming back
Mac
- 1. Press Cmd + Q to quit your browser
- 2. If that does not work, press Cmd + Option + Esc to force quit
- 3. Select Safari or Chrome and click "Force Quit"
- 4. Hold Shift when reopening Safari to stop it reloading the page
- 5. Clear your browser history and website data
Phone or tablet
- 1. Close the browser tab immediately
- 2. If the popup won't close, force close the browser app entirely
- 3. On iPhone, swipe up from the bottom and swipe the browser away
- 4. On Android, tap the square button and swipe the browser away
- 5. Clear your browser cache in Settings before reopening
The golden rule
Do not click anything inside the popup. Not "OK", not "Cancel", not the X button in the corner of the warning box. These buttons are fake and may trigger additional popups or start a download. Use your keyboard shortcuts or Task Manager to close the browser from outside.
If all else fails, hold the power button on your computer to force a shutdown. When you turn it back on, your computer will be fine. The "virus" was never real.
Who falls for this
More people than you would expect. The ONS estimated 4.2 million fraud incidents in England and Wales in the year ending March 2025, a 31% increase on the previous year. Fraud now accounts for roughly 41% of all crime. Of cases where fraudsters made direct contact, 39% began with a phone call (ONS Crime Survey for England and Wales 2025). That includes the calls people make after seeing a fake virus popup.
Older people living alone are targeted most often, but anyone can be caught out. The popup appears without warning, the alarm sound creates immediate panic, and the natural response is to follow the instructions on screen. IT professionals have been fooled by these pages when they appear on a relative's computer and they are trying to help over the phone. The NCSC has repeatedly warned that fake tech support alerts are one of the most reported types of scam in the UK.
Why the panic works
- • Alarm sounds trigger a stress response before you can think
- • The warning mimics trusted brands you recognise
- • A countdown timer creates false urgency
- • Full screen mode hides evidence that it is just a webpage
- • Most people have never seen a real virus alert and cannot compare
How to tell it is fake
- • Real virus warnings never include a phone number
- • Real alerts never play alarm sounds through your speakers
- • Real alerts never prevent you from closing your browser
- • Microsoft, Google, and Apple will never ask you to ring them from a popup
- • No real security software demands payment through a phone call
How to stop these popups appearing
Keep your browser up to date
Chrome, Firefox, Edge, and Safari all have built in protections against known scam pages. These only work if your browser is on the latest version. Enable automatic updates and restart your browser when it tells you an update is ready.
Use an ad blocker
Many fake virus popups come from malicious adverts on otherwise normal websites. A free ad blocker like uBlock Origin removes most of these before you ever see them. It is available for Chrome, Firefox, and Edge.
Block popups and redirects
In Chrome, go to Settings, then Privacy and Security, then Site Settings, then Popups and Redirects. Make sure this is set to "Don't allow sites to send popups or use redirects." Firefox and Edge have similar settings.
Turn off browser notifications from unknown sites
If you have accidentally clicked "Allow" on a notification prompt, scam warnings can appear even when you are not browsing. Go to your browser's notification settings and remove any websites you do not recognise.
Run Windows Defender or use built in protection
Windows Defender comes pre installed on every Windows PC and is perfectly good for most people. On a Mac, the built in XProtect does the same job. You do not need to buy expensive antivirus software. The irony is that these fake virus popups are often trying to sell you a "security package" when the free tools already on your computer are all you need.
Already called the number?
If you rang the number on the popup and let someone connect to your computer, act now. Speed matters here.
-
1
Disconnect from the internet
Turn off your WiFi or unplug your ethernet cable. This kills the remote connection straight away. If they are still connected to your machine, this stops them from doing anything more. Do this first.
-
2
Call your bank from your phone
Use the number on the back of your debit card or dial 159 (the UK Stop Scams helpline, which connects you to your bank's fraud team). Tell them what happened. They can freeze your account, block pending payments, and flag the account for monitoring. Do not use your computer to contact your bank because it may still be compromised.
-
3
Uninstall the remote access software
Remove TeamViewer, AnyDesk, UltraViewer, or whatever they had you install. On Windows, open Settings, go to Apps, and look for anything you do not recognise. If you are not sure what to remove, take the computer to a trusted local repair shop and explain what happened.
-
4
Change your passwords from a different device
Use your phone or tablet to change passwords for your email, online banking, and any other accounts you accessed while the scammer was connected. Start with your email account because if they can get into that, they can reset passwords for everything else.
-
5
Run a full malware scan
Once you are back online, run a full scan using Windows Defender (already on your PC) or download Malwarebytes (free version). Do a full scan, not a quick scan. This will pick up keyloggers or backdoor software they may have planted while they were connected.
-
6
Report it
Call Action Fraud on 0300 123 2040 or report online at actionfraud.police.uk. You will get a crime reference number. Keep it. You will need it if you make a claim to recover your money. In Scotland, report to Police Scotland on 101.
Where to report
Action Fraud
The national fraud reporting service for England, Wales, and Northern Ireland
NCSC Phishing Reporting
Forward suspicious emails to the National Cyber Security Centre
Forward scam texts to 7726
Your Bank (159)
The Stop Scams helpline connects you directly to your bank's fraud team
Police Scotland
If you live in Scotland, report fraud directly to Police Scotland
Frequently Asked Questions
Can a popup actually give my computer a virus?
How do I know if a virus warning is real?
I paid them for a "security package." Can I get my money back?
Why do these popups keep appearing on my computer?
My elderly parent got one of these. What should I tell them?
The short version
Red flags
- • A virus warning with a phone number on it
- • Alarm sounds or a robotic voice coming from your browser
- • A popup that will not let you close your browser
- • A countdown timer saying your files will be deleted
- • Anyone asking you to download remote access software
What to do
- • Close your browser with Task Manager or Force Quit
- • Do not call the phone number
- • Do not click anything on the popup itself
- • If you already called, disconnect from the internet and ring your bank
- • Report to Action Fraud (0300 123 2040)