Fake Antivirus Scams Paid via Prepaid Cards
Fraudsters selling non-existent or malicious antivirus software demand prepaid card payment, directing victims to share card numbers under the guise of subscription activation.
Part of: Fake Antivirus Scams
Last reviewed: 1 June 2026
Fake antivirus scams rely on manufactured fear: a pop-up or phone call warns of dozens of critical viruses on the victim's device, and the only solution is to purchase a subscription to a branded 'security suite.' Prepaid cards are commonly demanded because they sidestep banking fraud detection systems and do not require a credit card that could be disputed.
Once a victim purchases a prepaid card and shares the number, the scammer may go further — using any remote access granted during the 'installation' to extract banking credentials or deploy actual malware.
How this scam works on prepaid cards
A browser pop-up displays a fake virus scan running in real time, tallying dozens of critical threats. A phone number is shown to speak with a certified technician. The technician instructs the victim to purchase a prepaid Visa or gift card in a specified amount to activate their 'lifetime antivirus licence.'
In subscription renewal variants, the victim receives an email stating their antivirus subscription will renew at an inflated price and they should call to cancel. The 'agent' they reach steers them toward purchasing a prepaid card to 'process the refund,' eventually draining the card instead.
Some scammers install a program that appears to scan and find threats — reinforcing the necessity of the purchase — while actually doing nothing or installing spyware.
Common red flags
- Antivirus subscription or renewal payment is demanded in prepaid card form
- Browser pop-up displays an alarming virus count and urgent call-to-action
- Agent insists on prepaid cards rather than a credit card or PayPal payment
- After card numbers are provided, further payments are demanded for additional 'tiers'
- Software being installed is not from a recognisable, publicly listed security vendor
- Agent requests remote access to 'install' the purchased protection
How to protect yourself
- Legitimate antivirus software is purchased directly from vendor websites and never via prepaid cards over the phone
- Close browser pop-ups without calling any displayed number — open Task Manager to end a frozen browser
- Research any antivirus brand name independently before purchasing
- Never grant remote access to complete a software purchase
- If cards have been purchased, contact the issuer immediately to attempt a balance freeze
- Run a scan from a recognised security tool already installed on your device if you have genuine malware concerns
How to report it
- Report the fake pop-up URL to your browser's phishing report tool
- File a complaint with the FTC at reportfraud.ftc.gov
- Contact the prepaid card issuer's fraud line with the card numbers immediately
Frequently asked questions
Is my computer actually infected after seeing those pop-up warnings?
Not necessarily — fake virus pop-ups are designed to look alarming regardless of your computer's actual condition, and many appear even on healthy devices. Run a scan using security software installed directly from a known vendor's official website to check your device's real status.
The 'antivirus' software they installed still seems to be running. Should I keep using it?
No — uninstall it and run a scan with independently verified, reputable security software instead. Software installed during a scam call may do nothing useful or could include additional unwanted programs.
Can I get a refund on the prepaid card I used to pay?
Contact the prepaid card issuer's fraud department with the card details as soon as possible to ask whether any remaining balance can be frozen. If the full amount was already spent by the scammer, recovery becomes very unlikely.
How do I close a fake virus pop-up that will not go away?
Press Ctrl+Alt+Delete (Windows) or Command+Option+Escape (Mac) to open the task manager or force-quit dialogue. End the browser process directly. Do not click any button within the pop-up itself, as even the 'Close' button may trigger a download or phone call.