Protection Tools

Tech Support Scam Pop-ups: What Real Security Alerts Never Say

'3 viruses detected, call now' is one of the oldest scams online — and it still works. Here's how to tell a fake alert from a real one.

📅 Aug 7, 2026·⏱️ 5 min read·✍️ Cikal Studio Labs
🖥️

An Old Scam That Still Works

Tech support scams have been around for well over a decade, yet they remain one of the most financially damaging scams targeting everyday computer users, particularly older adults. The scam typically starts with a full-screen browser pop-up claiming your device is infected, urging you to call a phone number immediately. What happens next — a fake "technician" walking you through granting remote access, then either charging you for fake repairs or installing actual malware — can cost victims hundreds or thousands of dollars.

How the Pop-up Gets Triggered

These alerts are almost always just a webpage, not an actual system-level warning. They're triggered by malicious ads, compromised websites, or sometimes a browser extension that redirects you to a page using JavaScript tricks to make closing the tab difficult (endless confirmation dialogs, fullscreen mode, or a fake "your browser is locked" message). Despite looking urgent and official, nothing on the page has actually altered your operating system — it's designed purely to scare you into calling a phone number.

The Telltale Signs

  • Specific virus counts: "3 viruses detected" or similar precise-sounding numbers — real OS security tools don't announce infection counts via a browser pop-up.
  • Brand impersonation: claiming to be Microsoft, Windows Defender, or Apple Support, often with official-looking logos copied from the real company's website.
  • A phone number to call immediately: this is the single most reliable tell. No legitimate operating system vendor displays a support phone number in a security alert.
  • Claims that your browser or device is "locked": a scripted scare tactic, not an actual lock — closing via Task Manager or Force Quit almost always works.
  • Countdown timers: designed to create panic and stop you from pausing to verify.
  • Requests for remote access: once you call the number, the "technician" will ask you to install remote-access software like TeamViewer or AnyDesk.

What Real Security Alerts Actually Look Like

Genuine operating system security notifications appear as native system dialogs (not inside a browser tab), never include a phone number, never demand you call anyone, and never ask for remote access as a first step. Windows Defender and macOS's built-in protections handle detected threats automatically or through their own dedicated app interface — never through a webpage.

What to Do If You See One

Do not call the number. Do not grant remote access. Close the browser using Task Manager (Windows: Ctrl+Alt+Delete → Task Manager → End Task) or Force Quit (Mac: Cmd+Option+Esc). If the pop-up reappears on reopening the browser, restart your device first, then reopen your browser without restoring the previous session/tabs.

If You Already Called or Paid

If you granted remote access, disconnect from the internet and run a full malware scan, then consider a factory reset for critical devices. If you paid for "support" or software, contact your card issuer to dispute the charge, and consider changing passwords for any accounts you may have accessed while the scammer had remote access.

The Bottom Line

Tech support scam pop-ups rely entirely on panic overriding judgment. Slow down, remember the golden rule — real alerts never include a phone number — and you'll recognize the scam every time.

Frequently Asked Questions

How can I tell a fake virus pop-up from a real security alert?

Real OS security alerts never include a phone number to call, never lock your browser, and never ask for remote access. If a pop-up does any of these, it's a scam regardless of how official it looks.

What happens if I call the number in the pop-up?

You'll typically be connected to a scammer posing as a technician who tries to get remote access to your device or charge you for fake repairs — sometimes both.

Is there a tool that checks whether a scary pop-up is a tech support scam?

Yes — the Tech Support Scam Pop-up Detector scores pasted pop-up text for fake virus counts, brand impersonation, urgency, and remote-access requests. It's a one-time $4.99 purchase — no subscription, no account required.

How do I close a pop-up that says my browser is locked?

Use Task Manager on Windows (Ctrl+Alt+Delete) or Force Quit on Mac (Cmd+Option+Esc) to close the browser entirely, then restart your device before reopening it without restoring your previous tabs.

What should I do if I already gave a scammer remote access?

Disconnect your device from the internet immediately, run a full anti-malware scan, and change any passwords for accounts you may have been logged into during the session, ideally from a separate clean device.