How to Spot a Fake Tech-Support Pop-Up

A real security warning does not ask you to call a phone number on the screen. That is the test. Fake tech-support pop-ups are built to scare you into calling, handing over remote control of the computer, and paying with a gift card or a wire. The Federal Trade Commission says the goal is your money, and sometimes your identity.

This guide is for anyone who uses a computer at home, and especially for an older adult and the adult child who helps them. It is also for a parent whose child just yelled that the laptop said it was locked. Steps and warnings were checked against the FTC, the FBI and Microsoft on October 31, 2026.

Two rules that catch most of these scams

The FTC tells people to remember two things:

1. Legitimate tech companies will not contact you by phone, email, or text to say there is a problem with your computer.
2. Real security pop-up warnings and messages will never ask you to call a phone number.

If a window says your computer is infected and lists a phone number, it is the scam. You do not need to decide whether the logo looks real. Microsoft says plainly that its error and warning messages never include phone numbers, and that it will never ask you to pay for support with cryptocurrency or gift cards. The FTC said the same about security pop-ups in a 2025 consumer alert.

The same test covers a phone call. A caller who says they are from “the tech department,” Geek Squad, Norton, or Microsoft, and that they found a problem, is not calling because they found a problem. They are calling because you answered. Microsoft warns that scammers can fake the caller ID to show a real support number, and may already know your name from public directories. Hang up.

How the pop-up scam usually goes

The FTC describes a pattern, not a single script.

• A full-screen warning appears. It may use a logo you know. It tells you to call a number for help. Sometimes it beeps. Sometimes it will not close on the first click. That is theater. It is still a browser window.
• Other versions start with a call or a text, or with a search ad and a website that looks like tech support. The scammers hope you will call the number they placed there.
• On the phone, they ask for remote access. They pretend to scan the computer, say they found a virus, and offer to remove it for a fee. Microsoft notes that once they are connected, they can make normal system messages look like signs of trouble.
• They want payment that is hard to reverse. The FTC lists gift cards, wire transfers, bank transfers, cryptocurrency, and payment apps. Those are a second alarm. A real company can bill a card you already have on file, or you can pay them through a checkout you opened yourself.

The “Phantom Hacker” version that empties savings

The FBI has warned about a three-step version it calls the Phantom Hacker scam, which hits older adults hardest. Victims often lose entire bank, savings, retirement or investment accounts. It works like this:

1. Fake tech support. A pop-up, call, text or email sends you to a phone number. The “technician” installs remote-access software, runs a fake scan, then asks you to open your bank and investment accounts to “check for unauthorized charges.” They are really looking for the biggest balance.
2. Fake bank fraud department. A second person calls, claiming to be from that bank or brokerage. They say a foreign hacker is in your accounts and you must move your money to a “safe” account, sometimes described as an account at the Federal Reserve. They ask for wires, cash or cryptocurrency, often over days or months, and they tell you not to tell anyone the real reason.
3. Fake government agent. A third person claims to be from the Federal Reserve or another agency. If you hesitate, they may send an email or letter on official-looking letterhead.

Every part of that is fake. The FBI says the U.S. government will never ask you to send money by wire to foreign accounts, by cryptocurrency, or with gift or prepaid cards. The FTC adds that there is no “federal safety locker,” and a government employee will not tell you to move money to protect it or demand cash or gold. Being told to keep it secret, even from your own bank teller, is the loudest alarm of all.

The FTC also says scammers impersonate the FTC itself. The FTC will not threaten you, tell you to transfer money to protect it, or tell you to withdraw cash or buy gold.

The fake renewal message

Another version is an email or text that says you were charged hundreds of dollars to renew a tech-support subscription. The FTC says these messages use names such as Geek Squad, McAfee, and Norton. The message says you must call within 24 hours to dispute the charge. If you call, they want remote access, then they show a fake website and ask for a bank or card number to “refund” you. They then claim the refund was too large and insist you pay the difference with a gift card, a wire, crypto, or a payment app.

Do not use the phone number in that message. If you think a renewal might be real, look up the company’s number on their own website, or open the card account you actually use and see if the charge is there. The FTC says to report a real unauthorized charge to the card company or bank and ask for it to be reversed. If the charge is not on the account, the message was a scam. Delete it.

What to do when the pop-up is on the screen

1. Do not call the number. Do not click the pop-up’s buttons, including a button that says “close” if it is inside the warning. Those buttons are part of the page.
2. Close the browser. If the window will not go away, force-quit the browser, or restart the computer. You are closing a web page, not “unlocking” a seized computer.
3. Do not give anyone remote access because of that window. Remote access is how they move files and watch you type a password.
4. If you are worried the computer really has a problem, update the security software that came with the computer, or the security software you installed yourself from the company’s own site, and run a scan. The FTC recommends that. If you still want a person to look at it, use a store you already know, or a phone number you looked up yourself.
5. Tell someone before you pay anyone. The FTC says talking to a friend, a family member, or a neighbor is one of the ways people realize it is a scam. Agree on this in advance with an older parent: we do not call numbers that appear in warnings. We call each other first.

A child who sees this on a homework laptop should close the laptop and get an adult. They should not call the number, and they should not type a parent’s card “so the computer will work for school.” Tell them that ahead of time, the same way you tell them not to open the door to a stranger.

How to force a stuck browser closed

• Windows: press Ctrl + Shift + Esc to open Task Manager, select the browser, and choose End task. If even that will not open, hold the power button until the computer turns off, then turn it back on.
• Mac: press Command + Option + Esc, select the browser, and choose Force Quit.
• Phone or tablet: swipe the browser app away from the recent-apps view.

When you reopen the browser, do not click “restore pages” or “reopen tabs,” because that can bring the fake warning straight back. Start with a fresh home page.

If fake alerts keep popping up in the corner

Warnings that slide in from the corner of the screen, even when the browser is closed, often come from a website that was once allowed to send notifications. In your browser’s settings, search for “notifications” and remove any site you do not recognize. That stops the alerts without installing anything.

If money or a password already changed hands

The FTC’s advice if you gave a username and password: change that password now. If you reused it, change it on those other accounts too. Make the new one long and different. A password manager is a reasonable next step for the household, so the next reset is not the same word with a new number.

If you paid, contact the card company or bank if a card was involved. Gift cards, wires, crypto, and payment-app transfers are harder. Report the scam anyway. The FTC uses reports to build cases. File it at ReportFraud.ftc.gov. If you wired money or sent crypto, also report it to the FBI at ic3.gov. The FBI asks for the name of the person or company that contacted you, every phone number, website and email they used, and the account numbers and names the money went to. If they used Microsoft’s name, you can also report them at microsoft.com/reportascam.

If someone is still on the phone, hang up. If they have remote access, disconnect the computer from Wi-Fi and restart it. Then change the email password from a different device, because email is how they reset everything else.

What to skip

• Do not search “tech support phone number” and call the first result. The FTC says scammers buy those ads and those search listings.
• Do not keep them on the line while you “check with your bank.” Hang up. Call the number on the back of your card.
• Do not install a cleanup tool they name. That tool is part of the pitch.
• Do not trust caller ID. Microsoft says scammers can make it show a real support number.
• Do not be embarrassed into silence. These scripts are written to scare careful people. Reporting helps the next person.

Checklist

• Everyone in the house knows: a pop-up with a phone number is a scam.
• An older parent has one person they will call before they call any number on a screen.
• A child knows to close the laptop and get an adult, not to read a card number aloud.
• Everyone knows the force-quit keys for their computer.
• Remote-access requests from unexpected callers are a no.
• Gift cards, gold, and “move your money to protect it” are a no, including when the caller claims to be the bank, the Federal Reserve or the FTC.
• Renewal texts get checked against the real card statement, not against the number in the text.
• ReportFraud.ftc.gov and ic3.gov are bookmarked, or written on a card by the computer.

What this means for you

A parent should put the pop-up rule next to the other house rules: no calls from warnings, no card numbers to people who call you, no remote access for a stranger. The same week, set the device controls in Screen Time or Family Link so a child cannot install a random “cleaner” app.

An adult child should practice this once with a parent, on a calm day. Open a normal browser, point at the address bar, and say the warning will try to look official. Agree on the callback: “If a window tells you to call, you call me, and you do not call them.” Add a second rule for the Phantom Hacker version: “Nobody real will ever ask you to move your savings to keep it safe.” Leave your number on a card taped to the monitor. A taped card beats a contact buried in a phone they cannot unlock while they are scared.

If the computer really is slow, that is not proof the pop-up was right. Slow computers are common. The pop-up is still a lie. Get help from a person you already know.

FAQ

The pop-up will not close. Is my computer locked by the police?

No. The FTC describes these windows as scare tactics. Force-quit the browser or restart the computer. Police and federal agencies do not seize a home computer with a browser pop-up and a phone number.

Does Microsoft ever put a phone number in a warning?

No. Microsoft says its error and warning messages never include phone numbers, and it does not make unsolicited support calls.

They already have remote access. What now?

Disconnect from the internet and restart. Change your email password from a different device. Change any password you typed while they could see the screen. Call your bank on the number printed on your card if you moved money. Report it to the FTC, and to the FBI at ic3.gov if money was wired or sent as crypto.

My bank called and said to move my money to a safe account. Is that real?

No. That is the second step of the Phantom Hacker scam the FBI describes. Hang up and call the number on the back of your card or on your statement.

The caller knew my name. Does that make it real?

No. Names leak in data breaches and public directories. The test is still the request: a surprise computer problem, a phone number on a warning, remote access, gift cards, or moving money to “protect” it.

Should I pay to keep them from reporting me for a crime?

No. The FTC says a person who pretends to be the government and demands cash, gold, or a transfer is a scammer. Hang up and report it.

Sources

• Federal Trade Commission, “How To Spot, Avoid, and Report Tech Support Scams,” consumer.ftc.gov tech support scams, accessed September 23, 2026.
• Federal Trade Commission, “Seemingly urgent security messages could lead to tech support scams,” April 14, 2025, consumer.ftc.gov consumer alert, accessed September 23, 2026.
• FBI Internet Crime Complaint Center, “‘Phantom Hacker’ Scams Target Senior Citizens and Result in Victims Losing their Life Savings,” September 29, 2023, ic3.gov PSA, accessed October 31, 2026.
• Microsoft Support, “Protect yourself from tech support scams,” support.microsoft.com tech support scams, accessed October 31, 2026.

Photo: older adults using a tablet, by Sigismund von Dobschütz, CC BY-SA 3.0, via Wikimedia Commons.

This is not legal or financial advice. If you lost money, contact your bank or card issuer and report the scam to the FTC. Do not use a phone number that came from the scammer.

Update this guide if the FTC changes the payment methods it highlights, or if ReportFraud.ftc.gov moves.