Fake Microsoft Defender Antivirus Alert Scam
Scammers display browser pop-ups styled as Microsoft Defender security alerts, claiming a virus has been detected on the victim's PC, and pressure them into calling a fake helpline or installing remote-access software.
Part of: Fake Antivirus Scams
Last reviewed: 8 June 2026
Microsoft Defender (formerly Windows Defender) is the built-in antivirus included with Windows 10 and 11. Genuine Defender alerts appear as Windows Security notifications within the operating system itself — they never open a browser webpage or display a pop-up that locks your browser tab.
Criminals exploit the Defender name's credibility to run browser-based scare campaigns. A misleading ad or redirected URL causes a full-screen browser overlay to appear, complete with the Windows Security colour scheme, a red warning icon, and a loud alarm tone. The pop-up is designed to look as if Windows itself has detected a critical threat.
Victims who call the displayed number reach a call centre operated by scammers who guide them through installing remote-access software, ultimately stealing banking credentials, charging hundreds of dollars for fake 'cleaning services,' or locking the device until a ransom is paid.
How this scam works on the Microsoft brand
While browsing, the victim lands on a malicious or compromised site. JavaScript causes the browser window to go full-screen and display a page styled identically to a Windows Security dialog, complete with a progress bar showing '100% infected' and a countdown timer. The audio repeatedly says 'Warning: your computer is infected.'
The page provides a phone number labelled 'Microsoft Support: 1-800-XXX-XXXX.' When called, the 'technician' asks the victim to install software such as AnyDesk or TeamViewer. With remote access established, the operator fabricates virus scan results, accesses online banking 'to verify it has not been compromised,' and charges a fee via gift card or bank transfer for cleaning services that were never necessary.
Some variants install a persistent browser notification permission that continues to send alerts even after the original tab is closed.
Common red flags
- A browser page — not a Windows notification — displays a Microsoft Defender or Windows Security warning.
- The alert includes a phone number and urges you to call immediately.
- The browser appears to freeze or go full-screen and plays an alarm sound.
- The 'technician' asks you to install AnyDesk, TeamViewer, or a similar remote-access program.
- The support 'fee' is requested via gift cards, wire transfer, or cryptocurrency.
- The pop-up references your IP address or device serial number as 'proof' of infection — these are easily faked in a browser.
How to protect yourself
- Genuine Microsoft Defender alerts appear in the Windows Security app or as a Windows toast notification — never in a browser window.
- Press F11 or Escape to exit full-screen mode; if the browser remains frozen, use Task Manager (Ctrl+Shift+Esc) to close it.
- Microsoft never provides phone numbers in security alerts and will not call you unsolicited about viruses.
- Never install remote-access software at the direction of an inbound call or a browser pop-up.
- Run a genuine scan with Windows Security (Start > Windows Security > Virus & threat protection) if you are concerned.
- Revoke browser notification permissions for suspicious sites in your browser settings.
How to report it
- Report the scam page URL to Microsoft at microsoft.com/en-us/wdsi/support/report-unsafe-site.
- If you paid money or gave remote access, report to the FTC at ReportFraud.ftc.gov.
- UK users should report to Action Fraud at actionfraud.police.uk.
- Report the scam number to the FTC at donotcall.gov.
Frequently asked questions
Can Microsoft Defender alerts appear in a browser window?
No. Genuine Microsoft Defender alerts appear only within the Windows operating system as native notifications or within the Windows Security application. A browser page showing a Defender warning is always a scam.
I gave a stranger remote access to my computer — what should I do?
Disconnect from the internet immediately by unplugging your cable or disabling Wi-Fi. Change all passwords from a separate, clean device. Run a full scan with the real Windows Security app. Contact your bank if any financial accounts were accessed.
How do I stop browser pop-ups that look like virus alerts?
Go to your browser's settings, find Notifications under Privacy or Site Settings, and revoke permission from any sites you do not recognise. Installing a reputable ad blocker also reduces exposure to malicious ad redirects.