What you are looking at
It arrives while you are browsing, often after a mistyped address or an ad on an otherwise ordinary site. The screen goes full-size, there are warnings about stolen banking details, a robotic voice or an alarm tone starts, and the mouse feels stuck.
All of that is a web page. HTML, a sound file, and some JavaScript that asks the browser to go full screen and makes it awkward to close. It has no more access to your computer than any other page you visit, and it hasn’t scanned anything. The list of “infected files” and the countdown are just part of the page.
The giveaway is the phone number. Windows Security, Norton, McAfee and Apple don’t put support phone numbers in their virus warnings. Real security software tells you it has dealt with a problem and gives you a button to click.
So if a warning includes a phone number, it’s a scam.
Closing it safely
The one thing not to do is click anything inside the page. That includes the X in the corner of the fake warning box, the “Cancel” button, and the “Scan now” button. They’re all part of the same fake page.
Instead, close the whole browser from outside the page.
On Windows, press Ctrl+Shift+Esc to open Task Manager, find your browser in the list, and click End task. On a Mac, press Cmd+Option+Esc, select the browser, and choose Force Quit. Alt+F4 on Windows or Cmd+Q on a Mac often does it too, if the page has not grabbed the keyboard.
When you reopen the browser, decline any offer to restore the previous tabs, or the scam page will open again.
If a beeping sound continues after the browser is gone, that is a separate tab or window still open somewhere, not the computer. Closing the browser entirely ends it.
If you already rang
Plenty of people ring. These pages are designed to be alarming and the number looks official. Don’t be embarrassed about it, because embarrassment is often what stops people getting help quickly.
What happens on the call follows a script. They ask you to install a remote support tool so they can “check” the machine. They open Event Viewer or a command prompt and point at ordinary warnings as proof of infection. Then there is a fee, usually a few hundred dollars, sometimes for a multi-year “licence”.
If you only talked and hung up, you are fine. No money, no software installed, nothing to do.
If you let someone connect
Do these steps in this order.
Disconnect the machine from the internet. Unplug the network cable or turn the Wi-Fi off from the physical switch or the keyboard shortcut. This ends any live session immediately.
Change your passwords from a different device. Your phone, a tablet, another computer — anything but the machine they were on. Email first, because everything else resets through it, then banking, then anything sharing that password. Changing a password on a computer someone else may still be able to see simply gives them the new one.
Ring your bank. Not the number they gave you, and not a number from a search result. Use the number on the back of your card or in your banking app. Tell them a stranger had remote access to a device you use for banking, and ask what they recommend. Ask about the refund scam specifically: a common follow-up is a later call claiming to refund your fee, which is used to talk people through a transfer in the wrong direction.
Assume they saw anything typed during the session, including passwords and card numbers.
Have the machine checked properly. Remote tools are legitimate software, so antivirus will not necessarily remove them, and some leave behind an account or a scheduled task that lets them back in. This is hard to check yourself.
Why it keeps happening to the same person
It’s rarely a problem with the computer, or a sign that someone is being careless.
These pages arrive through advertising networks. A perfectly ordinary site sells ad space, the space is resold several times over, and something malicious ends up in the rotation for a few hours. The site owner usually doesn’t know, which is why these pages turn up on news sites and recipe blogs as well as dodgy ones.
Two things help. A content blocker in the browser removes most of the delivery mechanism, and keeping the browser updated closes the tricks that let a page take over the screen in the first place.
Don’t buy the “cleaner” or “optimiser” software that some pop-ups recommend. It’s often sold by the same kind of operators behind the scam pages.
Talking to family about it
People who ring these numbers usually know a virus is serious, which is why a convincing warning works on them.
If someone in your family might ring, give them two simple rules to remember. Real warnings never include a phone number. And if anyone asks to connect to the computer, hang up and call back on a number you’ve looked up yourself.
Those two rules also protect against the same scam when it arrives as a phone call.
