Fake Microsoft Defender Antivirus Alert Scam
Scammers display browser pop-ups styled as Microsoft Defender security alerts, claiming a virus has been detected on the victim's PC, and pressure them into calling a fake helpline or installing remote-access software.
Part of: Fake Antivirus Scams
Last reviewed: 8 June 2026
Microsoft Defender (formerly Windows Defender) is the built-in antivirus included with Windows 10 and 11. Genuine Defender alerts appear as Windows Security notifications within the operating system itself — they never open a browser webpage or display a pop-up that locks your browser tab.
Criminals exploit the Defender name's credibility to run browser-based scare campaigns. A misleading ad or redirected URL causes a full-screen browser overlay to appear, complete with the Windows Security colour scheme, a red warning icon, and a loud alarm tone. The pop-up is designed to look as if Windows itself has detected a critical threat.
Victims who call the displayed number reach a call centre operated by scammers who guide them through installing remote-access software, ultimately stealing banking credentials, charging hundreds of dollars for fake 'cleaning services,' or locking the device until a ransom is paid.
How this scam works on the Microsoft brand
While browsing, the victim lands on a malicious or compromised site. JavaScript causes the browser window to go full-screen and display a page styled identically to a Windows Security dialog, complete with a progress bar showing '100% infected' and a countdown timer. The audio repeatedly says 'Warning: your computer is infected.'
The page provides a phone number labelled 'Microsoft Support: 1-800-XXX-XXXX.' When called, the 'technician' asks the victim to install software such as AnyDesk or TeamViewer. With remote access established, the operator fabricates virus scan results, accesses online banking 'to verify it has not been compromised,' and charges a fee via gift card or bank transfer for cleaning services that were never necessary.
Some variants install a persistent browser notification permission that continues to send alerts even after the original tab is closed.
Common red flags
- A browser page — not a Windows notification — displays a Microsoft Defender or Windows Security warning.
- The alert includes a phone number and urges you to call immediately.
- The browser appears to freeze or go full-screen and plays an alarm sound.
- The 'technician' asks you to install AnyDesk, TeamViewer, or a similar remote-access program.
- The support 'fee' is requested via gift cards, wire transfer, or cryptocurrency.
- The pop-up references your IP address or device serial number as 'proof' of infection — these are easily faked in a browser.
How to protect yourself
- Genuine Microsoft Defender alerts appear in the Windows Security app or as a Windows toast notification — never in a browser window.
- Press F11 or Escape to exit full-screen mode; if the browser remains frozen, use Task Manager (Ctrl+Shift+Esc) to close it.
- Microsoft never provides phone numbers in security alerts and will not call you unsolicited about viruses.
- Never install remote-access software at the direction of an inbound call or a browser pop-up.
- Run a genuine scan with Windows Security (Start > Windows Security > Virus & threat protection) if you are concerned.
- Revoke browser notification permissions for suspicious sites in your browser settings.
How to report it
- Report the scam page URL to Microsoft at microsoft.com/en-us/wdsi/support/report-unsafe-site.
- If you paid money or gave remote access, report to the FTC at ReportFraud.ftc.gov.
- UK users should report to Action Fraud at actionfraud.police.uk.
- Report the scam number to the FTC at donotcall.gov.
Frequently asked questions
The pop-up showed my real IP address and computer name — doesn't that prove it's genuine?
No. Your IP address and basic device information are visible to any website you visit through your browser, and scammers deliberately display this information to make the warning feel personalised and credible. It is not evidence of an actual infection.
I paid for 'cleaning services' by wire transfer during one of these calls — can I get the money back?
Wire transfers are very difficult to reverse once completed, but contact your bank immediately to ask about a recall and report the fraud to the FTC. Recovery isn't guaranteed, so acting as quickly as possible improves your chances.
Will just closing the browser tab fix everything?
If you never installed anything or granted remote access, closing the tab and restarting your browser is usually enough since the pop-up itself is just a scary webpage. But if you installed remote-access software or downloaded a file at the scammer's direction, run a genuine scan with Windows Security and consider having the device checked professionally.
Can Microsoft Defender alerts appear in a browser window?
No. Genuine Microsoft Defender alerts appear only within the Windows operating system as native notifications or within the Windows Security application. A browser page showing a Defender warning is always a scam.
I gave a stranger remote access to my computer — what should I do?
Disconnect from the internet immediately by unplugging your cable or disabling Wi-Fi. Change all passwords from a separate, clean device. Run a full scan with the real Windows Security app. Contact your bank if any financial accounts were accessed.
How do I stop browser pop-ups that look like virus alerts?
Go to your browser's settings, find Notifications under Privacy or Site Settings, and revoke permission from any sites you do not recognise. Installing a reputable ad blocker also reduces exposure to malicious ad redirects.