Legitimate Antivirus Warning vs Fake Antivirus Popup
How to tell a real security alert from a fake popup trying to get your money or remote access.
Last reviewed: 1 June 2026
Fake antivirus popups are designed to provoke immediate fear. They fill your screen with alarming language, flashing warnings, and phone numbers to call. Real security software behaves very differently: it works quietly in the background, alerts you within its own interface, and never provides a phone number to call or demands payment to remove a threat. If an alert appeared in a browser window, requires you to call a number, or locks your screen with no way to close it, it is almost certainly a scam.
Side-by-side comparison
| Real antivirus warning | Fake antivirus popup | |
|---|---|---|
| Alert location | Appears within the security software's own interface or system tray | Appears as a browser webpage or full-screen overlay |
| Phone number | Never provides a phone number to call for virus removal | Prominently displays a number to call 'immediately' |
| Payment | Subscription renewals via official account portal only | Demands immediate payment to 'remove' the virus |
| Remote access | Doesn't need you to install anything or grant remote access | Asks you to install a tool or grant remote control |
| Closability | Alert can be dismissed or addressed within the software | Designed to prevent closing; may use browser full-screen tricks |
| Urgency language | Factual, measured language describing findings | Extreme urgency: 'Your device is infected RIGHT NOW' |
Common red flags
- Security alert appearing in a browser window rather than security software
- Phone number displayed for you to call about the virus
- Payment demanded immediately to remove a detected threat
- Request to install remote-access software to fix the problem
- Unable to close the window or browser tab normally
- Extreme, panicked language designed to provoke immediate action
Verification steps
- Close the browser tab — press Alt+F4 or use Task Manager if necessary; a web page cannot actually scan your device
- Open your actual installed security software and check whether it reports anything
- Do not call any number displayed in a browser-based security alert
- Run a scan using your real, installed security software to check for any genuine issues
- Keep your operating system and security software up to date to reduce genuine vulnerabilities
What not to do
- Don't call the phone number in a browser-based popup
- Don't pay for 'virus removal' in response to a browser alert
- Don't install remote-access tools prompted by a popup
- Don't assume closing the browser tab means you were infected — you almost certainly weren't
A safe response
Close the browser window or tab. A website cannot scan your device for viruses — the popup is a scare tactic. If you're concerned, run a scan with your real, installed security software. If you've already called the number or installed something, see the recovery steps for remote-access scams.
Frequently asked questions
Can a website actually detect viruses on my device?
No. Websites run inside a sandboxed browser environment and cannot scan your operating system or files. Any browser-based 'virus detected' alert is a fake designed to cause panic.
What if the popup won't close and is blocking my screen?
Use keyboard shortcuts: Alt+F4 to close the window, or Ctrl+Shift+Esc to open Task Manager and end the browser process. You can restart your browser and choose not to restore the previous session.
I called the number — what should I do?
If you didn't give remote access or payment details, you are likely fine. If you did grant remote access, see the remote-access scam recovery steps and change your passwords from a different device.