A warning displayed inside a browser tab — especially one that appears while you are visiting an unrelated site, claims your device is infected, and pairs that claim with pressure to call a phone number — can be a deceptive webpage rather than a genuine system notification. Full-screen appearance alone does not establish whether a warning is genuine one way or the other: what matters is which application actually produced it, and whether the specific claims it makes match what that application’s real vendor says it would do. The FTC’s guidance on this pattern states plainly that security pop-up warnings from real tech companies will never ask you to call a phone number. Separately, Microsoft’s own support guidance states that genuine Microsoft error messages never include a phone number to call. Those two specific, cited statements — not a claim about every operating-system or security vendor worldwide — are what this guide relies on: a phone number paired with an urgent security claim is a pattern neither the FTC’s nor Microsoft’s own guidance associates with a genuine warning from either of them. When you are unsure which application produced a warning, identifying it and checking that vendor’s own guidance independently is more reliable than judging by appearance alone.
Browser-page warnings versus genuine operating-system notifications
A real security notification from Windows, macOS, iOS, or Android is generated by the operating system itself and appears using that system’s own native notification design — not inside a webpage, and not while you happen to be browsing an unrelated site. An ordinary webpage does not have general access to inspect your operating system’s files or security status simply by being open in your browser; browsers do grant specific, permission-gated capabilities to some sites for narrow purposes, but a broad claim that a page has scanned your device and found threats describes something an ordinary webpage is not positioned to do. A browser-page warning is simply a page constructed to resemble a system alert — using familiar logos, urgent coloring, and sometimes an alert sound — presented as though it reflects a genuine scan, which for the reasons above is not a credible claim for an ordinary webpage to make.
Full-screen and notification-permission abuse
Two related but distinct mechanisms are used to make these warnings feel more urgent and harder to escape. Some pages request full-screen mode through the browser’s standard Fullscreen API, a legitimate feature (used, for example, by video players and games) that can also make a warning appear to occupy the entire screen the way a genuine system alert might, including obscuring the browser’s own address bar and controls. The precise transition and exit interface varies by browser and operating system; MDN documents that users can leave Fullscreen API mode with Escape or F11 on supported desktop browsers, and that changing tabs or applications also exits it. Separately, some sites first request notification permission through the browser’s Notifications API — sometimes disguised as an unrelated “click allow to continue” prompt — and then use that permission to deliver similar warnings later, even after you have left the original page. See Browser Notification Scams and How Permission Abuse Works for how that permission-based version works in more detail; declining notification permission requests from unfamiliar sites is a relevant precaution against this specific escalation.
Fake phone numbers and remote-access requests
In the scam pattern documented by the FTC and Microsoft, the number displayed in the warning leads to an imposter rather than the company named on the page. The person answering may claim to confirm the infection the page described, then request remote access to your device — through legitimate remote-access software installed for this specific purpose — to “diagnose” or “fix” the supposed problem. What that access actually allows the caller to see or do depends on the specific software, the permissions it requests, and the settings involved — it is not automatically identical to what any particular legitimate technician’s tools would provide, and can range from screen viewing to more extensive control depending on the software and what you approve. Declining this request, from a number obtained through the warning itself rather than through a channel you already trust, is the point at which this pattern can be stopped before any such access is granted.
Safe ways to close or isolate a suspicious page
- Attempt to close the browser tab or window normally first.
- If a “close” control inside the warning itself appears to do nothing, or triggers another pop-up, avoid clicking further inside the page.
- Use your operating system’s task manager or force-quit function (Ctrl+Shift+Esc on Windows, Cmd+Option+Esc on macOS, or the app-switcher on mobile) to close the browser entirely rather than continuing to interact with the page.
- On reopening the browser, decline any prompt to restore previous tabs if you are unsure whether that would reload the same warning.
When forced shutdown may or may not be appropriate
Force-closing the browser resolves the immediate on-screen warning in the situations described above, since the warning is only a webpage and closing the browser removes it. A full device shutdown or restart is a separate, more disruptive action that is not automatically necessary just because a warning appeared — it becomes relevant primarily if the device continues behaving unexpectedly after the browser is closed (persistent pop-ups outside the browser, for instance), which can indicate something was installed rather than merely displayed. Restarting a device that is otherwise behaving normally after the browser closes is not required by this scenario alone.
Browser notification cleanup
If the warning reappeared as a notification even after closing the browser and reopening it, a notification permission was likely granted to the site at some point. Reviewing and revoking site notification permissions through your browser’s settings addresses this directly — see How to Stop Website Notification Spam in Chrome on Android for the specific steps in Chrome on Android. Notification support and the exact settings path vary by browser, operating system, and version, so the precise menu names may differ from what is shown there, but every major browser provides some way to review and revoke site notification permissions.
Download and extension checks
Check your browser’s downloads list and your device’s recent-downloads folder for anything saved around the time the warning appeared that you did not deliberately choose to download. Do not open any such file; delete it, and consider it alongside the security-scan recommendation below. Separately, review your browser’s installed extensions for anything unfamiliar, since some variants of this scam attempt to install a browser extension rather than, or in addition to, requesting a phone call.
Remote-access software considerations
If you granted remote access to a caller, treat the device as having been under another person’s control for the duration of that session, since that person could have viewed files, installed software, or changed settings during that window — a security scan alone does not fully account for actions taken through legitimate-seeming remote access rather than malware in the traditional sense. Uninstalling the remote-access software the caller instructed you to install is a reasonable step, alongside a full security scan and a review of accounts that may have been accessible from that device during the session.
Password and account recovery if information was disclosed
If you disclosed a password or other account credential during the call, change that password immediately from a separate, unaffected device, and change it anywhere else it was reused. Enable two-factor authentication on the affected account if it is not already active. Review the account’s recent login activity, where available, for anything you do not recognize. See What to Do After Clicking a Suspicious Link for the fuller set of steps covering different categories of disclosed information.
Payment-card or bank response if money was sent
If you paid the caller — by card, gift card, wire transfer, or any other method — contact the payment provider, card issuer, or bank as soon as possible to explain the situation and ask what dispute, cancellation, recall, or reporting options apply. Recovery options vary by payment method, provider, jurisdiction, timing, and whether funds or gift-card codes have already been used, so do not assume that any particular route can reverse the payment. Use contact details obtained independently from the provider’s official site, app, card, or statement rather than any number supplied by the caller.
A hypothetical example, worked through
The following is a hypothetical scenario, not a real incident. A red, full-screen page appears while browsing an unrelated site: “Windows Security Alert — 3 threats detected. Call Apple Support now: [number],” accompanied by a countdown timer and an alert sound. Working through the structure described above: the message pairs a security claim with a phone number, the specific pattern the FTC’s and Microsoft’s own guidance both describe as not how a genuine warning from either of them works. It also mixes an “Apple Support” label onto what claims to be a Windows alert — an internal inconsistency worth noticing on its own, since these are different companies’ products. The appropriate response is to force-close the browser without calling the number, then separately open the device’s actual installed security software directly, entirely independent of anything the warning displayed, to check for any genuine issue if reassurance is wanted.
Common variations worth recognizing
This pattern appears in several forms beyond the pop-up described above. A version delivered by phone, without any preceding webpage, involves someone calling directly and claiming to have remotely detected a problem with your device — the same underlying claim, delivered through a different channel, and it warrants the same response of declining and verifying independently rather than acting on the call itself. A version delivered through search advertising involves paid results appearing above genuine results when searching for a company’s “tech support” phone number, leading to the same style of scam despite starting from an ordinary search rather than a pop-up; checking a phone number against a company’s official site directly, rather than trusting a search result’s placement, addresses this variant specifically. A version aimed at account access rather than a general “infection” claim may instead warn of suspicious sign-in activity on a specific account and direct you to a fake login page rather than a phone number — the underlying pattern of urgency plus a request for access remains the same even though the specific mechanism differs.
What the response actually depends on
There is no single correct response to “I saw one of these warnings” — the appropriate action depends specifically on what you clicked, downloaded, executed, installed, allowed, or disclosed during the encounter. If you did not download or run anything, did not grant any permission or install any software, and did not disclose information or send payment, then closing the browser is the response this scenario calls for, without further steps being required by the encounter itself — though if you remain uncertain about exactly what happened, briefly checking your browser’s downloads list and recently granted site permissions is a reasonable way to confirm nothing occurred that you did not notice. Granting remote access, disclosing a password, installing a downloaded file, or sending payment each call for a different, specific response from the sections above, and more than one may apply if more than one of these things happened during the same encounter.
Frequently asked questions
Do real companies ever call customers proactively about a virus?
Based on the FTC’s and Microsoft’s own guidance cited in this article, neither describes proactively calling customers about a device infection as something they do. Treat an unsolicited call along these lines, whether or not it references a warning you saw, with the same caution described throughout this guide, and verify independently through a number you already know is correct rather than assuming the caller’s claim about who they represent.
How do these scams generate revenue?
Documented outcomes include charging a fee for fake “repair” services, gaining remote access to install further software, or persuading the target to purchase gift cards or make direct payments framed as a support fee.
Where do I report this?
File a report with the FTC. Reports contribute to the agency’s ability to track and act on the operations behind this pattern.
