Fake Antivirus Scams Paid via Prepaid Cards
Fraudsters selling non-existent or malicious antivirus software demand prepaid card payment, directing victims to share card numbers under the guise of subscription activation.
Part of: Fake Antivirus Scams
Last reviewed: 1 June 2026
Fake antivirus scams rely on manufactured fear: a pop-up or phone call warns of dozens of critical viruses on the victim's device, and the only solution is to purchase a subscription to a branded 'security suite.' Prepaid cards are commonly demanded because they sidestep banking fraud detection systems and do not require a credit card that could be disputed.
Once a victim purchases a prepaid card and shares the number, the scammer may go further — using any remote access granted during the 'installation' to extract banking credentials or deploy actual malware.
How this scam works on prepaid cards
A browser pop-up displays a fake virus scan running in real time, tallying dozens of critical threats. A phone number is shown to speak with a certified technician. The technician instructs the victim to purchase a prepaid Visa or gift card in a specified amount to activate their 'lifetime antivirus licence.'
In subscription renewal variants, the victim receives an email stating their antivirus subscription will renew at an inflated price and they should call to cancel. The 'agent' they reach steers them toward purchasing a prepaid card to 'process the refund,' eventually draining the card instead.
Some scammers install a program that appears to scan and find threats — reinforcing the necessity of the purchase — while actually doing nothing or installing spyware.
Common red flags
- Antivirus subscription or renewal payment is demanded in prepaid card form
- Browser pop-up displays an alarming virus count and urgent call-to-action
- Agent insists on prepaid cards rather than a credit card or PayPal payment
- After card numbers are provided, further payments are demanded for additional 'tiers'
- Software being installed is not from a recognisable, publicly listed security vendor
- Agent requests remote access to 'install' the purchased protection
How to protect yourself
- Legitimate antivirus software is purchased directly from vendor websites and never via prepaid cards over the phone
- Close browser pop-ups without calling any displayed number — open Task Manager to end a frozen browser
- Research any antivirus brand name independently before purchasing
- Never grant remote access to complete a software purchase
- If cards have been purchased, contact the issuer immediately to attempt a balance freeze
- Run a scan from a recognised security tool already installed on your device if you have genuine malware concerns
How to report it
- Report the fake pop-up URL to your browser's phishing report tool
- File a complaint with the FTC at reportfraud.ftc.gov
- Contact the prepaid card issuer's fraud line with the card numbers immediately
Frequently asked questions
How do I close a fake virus pop-up that will not go away?
Press Ctrl+Alt+Delete (Windows) or Command+Option+Escape (Mac) to open the task manager or force-quit dialogue. End the browser process directly. Do not click any button within the pop-up itself, as even the 'Close' button may trigger a download or phone call.