A pop-up says my computer is infected — what now?

If a browser pop-up says your computer is infected or locked, it is a web page, not your computer — close the browser (force-quit it if it will not close normally: Task Manager on Windows, Force Quit on a Mac). If you got an unsolicited call saying the same thing, hang up; no company can detect a virus on your machine from the internet. In neither case should you call the number shown or install anything at its request. If you already have, see "if it has already happened" below.

This is a tech support scam: every other scam on this site persuades you to hand over money or a credential, but this one persuades you to hand over your computer, and you install the tool that does it yourself.

The FBI names tech support fraud among the costliest tactics in its 2025 reporting, alongside business email compromise and personal data breaches. It is also the category that disproportionately affects older adults, for whom phone calls remain the leading contact method for scam losses.

How contact starts

The browser pop-up

A full-screen page appears — Windows or Apple branding, an alarm sound, a warning that your computer is infected and locked, and a support number to call. Closing it appears impossible; the page traps the back button and reopens.

The unsolicited call

Someone from "Microsoft", "Apple", or your internet provider says your computer is sending error reports, or has been compromised, and they are calling to help.

The subscription renewal email

"Your antivirus subscription renews tomorrow for £399.99. To cancel, call this number." The absurd amount is deliberate — it produces an angry call to a number the scammer controls, and you have initiated the contact, which feels safer.

The critical step

Everything so far is theatre. The scam turns on one action: installing remote access software.

It is presented as standard support practice, and legitimate versions of these tools genuinely exist — AnyDesk, TeamViewer, and others are used by real helpdesks daily. That is what makes the request plausible.

Once connected, the scammer can:

• Show you fabricated evidence. Windows Event Viewer is full of routine warnings that look alarming when narrated as infections.
• Run harmless commands that produce impressive output.
• Read anything on the machine — documents, saved passwords, browser sessions.
• Access any account you are logged into.
• Install genuine malware for later.

The refund overpayment

The most financially damaging variant, and it usually comes weeks or months later.

You are told a refund is owed — the service was not provided, or the company is closing. To process it, they need remote access again.

Then, with your online banking on screen, they appear to transfer the refund. Except the amount is wrong: they apparently sent £5,000 instead of £500. The screen shows it.

The number on screen is edited. Nothing was transferred. But the balance appears to have changed, the "technician" is distraught about the mistake and the trouble it will cause them, and you are asked to return the difference — by bank transfer, gift card, or cryptocurrency.

That transfer is real, and it comes from your own money.

The rules

Supporting habits:

• You initiate support, always. Through the company's official site or app, never a number from a pop-up, email or call.
• A number in a warning message is the scammer's number. That is its purpose.
• Real support does not need your bank account open.
• Never pay for support in gift cards.

If it has already happened

1. Disconnect from the internet. Wi-Fi off, or cable out.
2. Uninstall the remote access software they had you install.
3. Run a full malware scan with reputable security software.
4. Change passwords from a different device — email and banking first. If the machine is compromised, changing passwords on it hands over the new ones.
5. Call your bank on the number on your card. Tell them exactly what happened; they deal with this pattern regularly.
6. Report it — ReportFraud.ftc.gov and ic3.gov, or Action Fraud in the UK.
7. If it is a work device, tell IT immediately. Speed matters far more than embarrassment.

And expect a follow-up. Anyone who has paid once is on a list, and the refund variant exists precisely to revisit earlier victims.