Tech Support Pop-Up Scam: 'Call Microsoft or Apple' Warning Signs

If a pop-up tells you to call Microsoft, Apple, or any tech company, do not. It is a scam. Close the tab (force quit if needed), clear your browser data, and verify through official support channels if you are concerned.

{{component-cta-custom}}

How Tech Support Scams Actually Work

A tech support scam is not really about technology. It is a social engineering attack that uses fear to get you on the phone, then manipulation to get you to install remote access software and pay for fake services.

The pop-up is just the hook. The real attack happens during the phone call, when a convincing "technician" guides you through installing software that gives them complete control of your computer.

The Scam Flow

Real Tech Support Scam Scripts (And Why They Work)

Example 1: The Windows Security Alert

What the pop-up says:

"Windows Defender Alert: Your computer has been infected with Trojan spyware. Your passwords, banking details, and personal files are at risk. Do not restart your computer. Call Microsoft Support immediately: 1-888-XXX-XXXX"

Why people fall for it:

• "Windows Defender" is a real Microsoft product - it sounds official
• "Trojan spyware" is a real threat category
• The specific risks (passwords, banking) feel personal and urgent
• "Do not restart" creates a sense that any action could make things worse
• The phone number looks like a legitimate toll-free support line

Reality: This is a web page, not a system alert. It has no access to your computer. Windows Defender alerts appear in the system tray, not in browser pop-ups.

Example 2: The Apple Security Warning

What the pop-up says:

"Your Mac is infected with 3 viruses. System damage: 28.1%. Immediate action required. Call Apple Support: 1-800-XXX-XXXX to prevent complete system failure."

Why people fall for it:

• Mac users often believe they are immune to viruses, so a warning feels serious
• "28.1% system damage" is oddly specific, making it feel measured
• "Complete system failure" is scary
• The Apple branding looks legitimate

Reality: Apple does not display virus warnings in browser pop-ups. There is no such thing as "system damage percentage." This is a web page using Apple branding.

Example 3: The Browser Lock

What happens:

The browser appears frozen. Every attempt to close produces more pop-ups. Audio plays: "Your computer has been locked. Call this number immediately."

Why people fall for it:

• The browser genuinely seems unresponsive
• Multiple pop-ups create a sense of escalating emergency
• Audio makes it feel like the computer is talking to you
• The "locked" framing suggests you need help to unlock it

Reality: The browser is not locked - it is running JavaScript that spawns pop-ups. Force quitting the browser ends it immediately.

What Happens If You Call

The person who answers sounds professional. They may have an American accent (or may not). They will follow a script designed to:

1. Establish authority: "This is Microsoft Technical Support" or "Apple Security Center"
2. Confirm the "problem": They ask you to open Event Viewer (Windows) or Console (Mac), which always shows normal errors they can misrepresent as threats
3. Get remote access: They guide you to download AnyDesk, TeamViewer, or another remote access tool
4. Demonstrate "threats": They run commands that show normal system information, claiming these are viruses
5. "Fix" the problem: They run meaningless commands or install their own software
6. Demand payment: $200-$500 is common, often via gift cards or wire transfer

What They Actually Do With Remote Access

If You Already Called or Gave Remote Access

Immediate Steps

1. Disconnect from the internet: Unplug ethernet or disable WiFi. This cuts their access immediately.
2. Uninstall remote access software: Remove AnyDesk, TeamViewer, LogMeIn, or any unfamiliar programs they had you install.
3. Run a legitimate security scan: Use Windows Defender, Malwarebytes, or your existing security software.
4. Change your passwords from a different device: Assume any passwords saved in your browser or typed during the session are compromised.

Account Security

1. Change passwords for email, banking, and any sensitive accounts
2. Enable two-factor authentication everywhere possible
3. Check for unauthorized transactions or login activity
4. Review your email for password reset requests you did not make
5. Check for email forwarding rules that may have been added

If You Paid

1. Contact your bank or credit card company immediately
2. If you paid with gift cards, contact the gift card company (recovery is unlikely but worth trying)
3. Document everything: phone numbers, amounts, what software was installed
4. Report to the FTC at ReportFraud.ftc.gov
5. File a report with your local police if significant money was lost

{{component-tips}}

How Guardio Stops Tech Support Scams

Tech support scam pages often arrive through malicious ads (malvertising) or compromised websites. Guardio provides protection before you see the scary pop-up:

• Malicious ad blocking: Many tech support scams are delivered through advertising networks. Guardio blocks the malicious redirects that lead to scam pages.
• Known scam page detection: Guardio maintains a database of known tech support scam domains and blocks them before they load.
• Behavioral detection: Even new scam pages exhibit patterns - fake security alerts, phone numbers in browser windows - that Guardio recognizes.
• Redirect chain analysis: Scam pages often use multiple redirects to evade detection. Guardio follows the chain and evaluates the final destination.

{{component-cta-custom}}

How to Get Legitimate Tech Support

Report Tech Support Scams

• FTC: ReportFraud.ftc.gov
• Microsoft: Report a tech support scam
• Apple: Report phishing
• Your browser's "Report suspicious site" feature

Sources

• FTC: How to Spot, Avoid, and Report Tech Support Scams
• Microsoft: Protect Yourself From Tech Support Scams
• FBI IC3: Tech Support Fraud
• AARP: Tech Support Scams
• Guardio Labs: DeceptionAds Malvertising Campaign