Fake Antivirus Popups: How to Spot and Ignore Them

Fake antivirus popups — sometimes called "scareware" — are among the most widely deployed tools in the tech support scammer's playbook. They are designed with a single objective: to frighten you badly enough that you take immediate action, specifically calling a phone number or clicking a download button, without stopping to think critically about what you are seeing.

For younger, more tech-savvy users, these popups are obvious. But for older adults who grew up in an era when computer error messages meant something was genuinely wrong, a screaming red popup claiming your device has been compromised can be extremely convincing. Understanding exactly what these alerts look like and why they are always fake is the best defense.

What Fake Antivirus Popups Look Like

Scareware popups are specifically designed to mimic the look of legitimate security software and operating system alerts. Common design elements include:

• Bright red or orange color schemes with official-looking logos (often mimicking Windows Defender, McAfee, Norton, or Microsoft)
• Urgent all-caps text such as "YOUR COMPUTER HAS BEEN INFECTED" or "CRITICAL SECURITY WARNING"
• A list of supposed threats with technical-sounding names like "Trojan.GenericKD" or "Backdoor.Win32.Ramnit"
• A phone number to call immediately for "Microsoft Support," "Windows Technical Support," or a similarly official-sounding helpdesk
• An audio alarm or robotic voice saying things like "Your computer has been blocked" or "Do not shut down your computer"
• A countdown timer creating a sense of urgency — "Your files will be deleted in 5:00 minutes"
• Buttons that don't work — the X to close the window is often disabled or clicking it opens additional popups

The combination of official-looking graphics, alarming language, and audio alerts can be genuinely distressing. Many victims describe feeling their heart rate spike and their hands shake. That physical panic response is exactly what the scammers are engineering.

Why Legitimate Security Software Never Does This

This is the most important fact to understand and share with elderly relatives: no legitimate antivirus software, no legitimate operating system, and no legitimate company will ever display a phone number and tell you to call for help through a browser popup.

Real security software — Windows Defender, Norton, McAfee, Malwarebytes — communicates through its own dedicated interface, not through your web browser. If your computer had a genuine virus, your real antivirus software would display an alert in the system tray or through its own application window. It would never open a browser tab with a phone number. It would never play an alarm and tell you not to turn off your computer.

Microsoft's actual support line is 1-800-642-7676. Microsoft will never call you, and they will never instruct a website to display an emergency popup telling you to call them. Any browser popup claiming to be from Microsoft is definitively fraudulent.

"Legitimate security software never asks you to call a phone number. If a webpage is telling you to call someone to fix your computer, it is a scam — close the browser." — Microsoft Security Intelligence

How These Scams Make Money

When a frightened senior calls the number displayed in a fake antivirus popup, they reach a scammer operating what looks and sounds like a professional call center. The caller is told that yes, the situation is serious, and that a technician needs remote access to fix the problem. The senior is instructed to download a remote access tool — often a legitimate program like AnyDesk or TeamViewer — and give the caller control of their computer.

From that point, several monetization paths exist. The scammer may charge hundreds or even thousands of dollars for "removing the viruses" — which never actually existed. They may install genuine malware while pretending to clean the system. They may browse through financial documents, saved passwords, or banking websites visible on the desktop. Some scammers sell "annual support plans" that result in recurring charges on the victim's credit card for years.

What to Do When a Scary Popup Appears

The correct response to any alarming browser popup, regardless of how convincing it looks, is to close it without calling any number or clicking any button within it. Here is the safest step-by-step approach:

1. Do not call the phone number. No matter how official it looks, do not dial it.
2. Do not click anything inside the popup. Clicking "OK," "Cancel," or any button within the popup window can trigger downloads or open additional malicious pages.
3. Try closing the browser tab. If you can close the specific tab, do so. On most browsers, right-click the tab and select "Close Tab."
4. If the browser is frozen, close the entire browser. Right-click the browser icon in the taskbar and select "Close Window," or use Task Manager (Ctrl+Alt+Delete on Windows) to end the browser process.
5. If nothing works, restart the computer. Simply turning it off and back on will close any open browser windows and clear whatever was causing the popup.
6. After restarting, run your real antivirus software — the one you normally use — to confirm that your computer is clean.

If a family member has already called the number and given remote access, disconnect from the internet immediately (unplug the ethernet cable or turn off WiFi), then call your bank to monitor for suspicious activity and consult a local computer repair professional to check whether any software was installed.

How GrannySafe Helps

One of the most common ways seniors reach fake antivirus popup pages is through malicious advertisements on legitimate websites, or by clicking links in scam emails and text messages. GrannySafe's browser extension monitors for known scam domains and scareware patterns in real time, blocking the page before it loads and explaining in plain language why the site was blocked. This means the terrifying popup never appears in the first place.

For a complete picture of the tech support scam ecosystem, read our guides on Microsoft tech support scams and how to identify fake tech support phone numbers before you call them.