# Tech support scam popups

> Tech support scam popups show fake virus warnings to push you into calling a scam number. How they work, how to escape one, and how PhishClean blocks them.

Canonical: https://www.phishclean.com/threats/tech-support-scam-popups
Last updated: 2026-11-05

You're browsing normally when your screen suddenly fills with a blaring red warning: "YOUR COMPUTER HAS BEEN INFECTED. Call Microsoft Support immediately at 1-800-XXX-XXXX." The page won't close. An audio voice loop tells you not to shut down your computer. It looks like Windows or macOS is talking to you. It's not. It's a webpage — built to scare you into calling a scam call center.

The FTC reported $924 million in losses from tech support scams in 2023, with a median individual loss of $1,480. Victims over 60 accounted for the highest total losses, often paying through gift cards or wire transfers that are nearly impossible to recover.

## How tech support scam popups work

The scam is straightforward but effective. It combines browser tricks with social engineering to make you believe your computer is compromised — when in reality, you're just looking at a web page. No malware is involved at the popup stage. The real damage starts when you pick up the phone.

1

### Malicious ad or redirect

You land on the scam page through a malvertising ad, a compromised website, a typosquatted domain, or a search result that redirects. Sometimes it's triggered by clicking a link in a [phishing email](https://www.phishclean.com/threats/phishing-attacks). The redirect chain is designed to bypass ad network filters.

2

### Full-screen fake warning

The page enters fullscreen mode (or uses CSS tricks to simulate it), displays a fake Windows Defender or Apple Security alert, and often plays an audio warning on a loop. JavaScript dialogs and [hidden iframes](https://www.phishclean.com/threats/hidden-iframe-attacks) make it difficult to close the tab or navigate away. The goal is to make you panic.

3

### Call the number

The fake alert prominently displays a phone number. When you call, a person answers pretending to be from Microsoft, Apple, or your ISP. They speak calmly, use technical jargon, and walk you through "diagnostic steps" that are actually just normal system logs made to look alarming.

4

### Remote access + payment

The scammer asks you to install remote access software — AnyDesk, TeamViewer, or UltraViewer. Once connected, they "find problems" (Event Viewer errors that every PC has) and demand payment to "fix" them. Fees range from $200 to $1,000+, paid via gift cards or wire transfer. Some also install actual malware or steal files while they have access.

## Real-world examples

### Fake Windows Defender alert

A full-screen page mimics the Windows Defender interface with a red banner reading "Trojan Spyware Alert — Error Code: #0x898778." The Windows logo, system fonts, and a fake scan progress bar make it look authentic. An audio loop repeats "Do not restart your computer" while a prominent phone number flashes in the center. The page uses `document.documentElement.requestFullscreen()` to hide the browser chrome.

### Fake Apple security warning

Safari users see a popup styled like a macOS system dialog: "Your Mac is infected with 3 viruses. Immediate action is required." The page background shows a blurred fake desktop. Clicking anywhere triggers additional JavaScript alerts that make it seem impossible to leave. The "Apple Support" number connects to an overseas call center.

### Browser-based fullscreen lockout

A page requests fullscreen permission, then overlays a fake operating system screen complete with a taskbar and desktop icons. It displays a fake Blue Screen of Death or kernel panic, followed by a "recovery" screen with a support number. Users who don't know how to exit fullscreen (press Escape or F11) believe their computer has crashed.

## How to escape a tech support scam popup

- **Force-close your browser.** Press `Ctrl+Shift+Esc` (Windows) or `Cmd+Option+Esc` (Mac) to open your task manager. End the browser process entirely. If fullscreen is trapping you, press `Esc` or `F11` first. The popup is just a web page — closing the browser eliminates it.
- **Never call the number.** Microsoft, Apple, and Google will never display a phone number in a browser popup asking you to call them. Any popup telling you to call a number is a scam, without exception. No legitimate security alert works this way.
- **Clear your browser data.** After closing, clear your recent browsing history and cache to prevent the scam page from reloading when you restore tabs. In Chrome, go to Settings > Privacy > Clear browsing data. Check our guide on [how to remove fake virus popups](https://www.phishclean.com/blog/how-to-remove-fake-virus-popup) for step-by-step instructions.
- **Report the site.** Report the URL to [Google Safe Browsing](https://safebrowsing.google.com/safebrowsing/report_phish/) and the [FTC](https://reportfraud.ftc.gov/). This helps get the domain blocklisted so fewer people see it. If you already called and paid, contact your bank immediately and file a report at [ic3.gov](https://www.ic3.gov/).

## How PhishClean protects you

Every one of these pages has the same job: get you to call. So PhishClean looks for the combination a real alert never has, a security warning plus a support number to ring. Since version 1.5.0 (October 2026):

- **Fake virus warnings**: a page that prints a toll-free support number together with the scam's stock phrases ("your computer has been blocked", "do not close this window", "call Microsoft Support", fake `0x` error codes) gets a full-screen PhishClean warning that says plainly the computer is fine and the number goes to scammers. If the page has grabbed fullscreen to hide your browser, the warning takes it back. Phrases quoted in an article don't count, so news stories about these scams are left alone.
- **Reported scam and phishing sites**: hosts on a list of about 380,000 reported phishing sites are blocked, on the free plan as well as the paid one.
- **[Hidden iframes](https://www.phishclean.com/threats/hidden-iframe-attacks)**: zero-size and off-screen third-party frames, which some scam pages use to layer fake interface over a real site, are flagged.
- **Zero browsing data collected**: every check runs in your browser against the page in front of you, so we never see what you browse. See the [privacy policy](https://www.phishclean.com/privacy).

What it does not do: it can't stop a site asking for notification permission. If fake warnings keep popping up from the corner of your screen, that is a permission you granted at some point; [here is how to remove it](https://www.phishclean.com/blog/how-to-remove-fake-virus-popup#turn-off-notifications).

## Related threats & resources

- [Phishing attacks](https://www.phishclean.com/threats/phishing-attacks): Tech support scams often start with a phishing email that redirects to the fake warning page.
- [Hidden iframe attacks](https://www.phishclean.com/threats/hidden-iframe-attacks): Scam popups use invisible iframes to trap your browser and layer fake UI elements.
- [Remove fake virus popups](https://www.phishclean.com/blog/how-to-remove-fake-virus-popup): Step-by-step guide to closing, clearing, and recovering from fake security alerts.
- [Protect elderly parents online](https://www.phishclean.com/blog/protect-elderly-parents-from-online-scams): Older adults lose the most to tech support scams. Here's how to set up their browser safely.
- [How to check if a website is safe](https://www.phishclean.com/blog/how-to-check-if-website-is-safe): Quick checks you can do before trusting any website with your information or attention.

## Block tech support scams automatically

PhishClean warns about fake virus pages and reported scam sites before you pick up the phone. Free for 7 days with no account, on Chrome, Firefox and Edge.

[Install PhishClean](https://www.phishclean.com/#install)

Last updated: 5 November 2026