Fake Antivirus Scams

Fake antivirus scams — also called scareware — display alarming pop-up warnings claiming your device is infected with viruses, spyware, or malware. The goal is to panic you into taking an action that benefits the scammer: buying useless or outright malicious 'security' software, calling a fake support line, or granting remote access to your device.

These warnings mimic the look of legitimate operating-system alerts, complete with realistic-looking progress bars, scan animations, inflated threat counts, and official-sounding product names. Some go further, locking the browser window so that normal ways of closing it appear to be disabled. The scam can arrive through malicious online advertisements, free software bundled with hidden extras, or by visiting a compromised website.

The software being sold — if you pay for it — either does nothing at all or is itself malware. A variant skips the software purchase entirely: instead you're directed to call a phone number where a 'technician' will helpfully walk you through allowing them remote control of your device to 'remove' infections that never existed.

Scareware has been a persistent threat for many years precisely because urgency and fear are powerful motivators. When something looks like an official warning from your own computer, the instinct to act immediately is hard to override. Understanding that no website has the ability to scan your device is the single most important fact to remember when encountering these warnings.

The scam typically begins when you encounter a malicious advertisement or visit a website that has been compromised. A pop-up fills or blocks your screen, often accompanied by alarm sounds and an automated voice reading out a warning. A fake 'scan' animation runs and reports finding multiple threats, creating a sense that the danger is real and immediate. A countdown timer may appear, suggesting you have only seconds to act before your data is permanently lost.

At this point you are presented with one or more options: buy a security product with a credit card, call a phone number to speak with 'support', or download a 'removal tool'. Each path serves the scammer in a different way.

If you purchase the software, you may receive something that installs but does nothing, a product that makes your device worse, or simply lose your money with nothing delivered at all. Your card details are also now in the scammer's hands.

If you call the number, you reach someone claiming to be a technician. They will ask you to install remote-access software so they can 'fix' the problem. Once connected, they can read your saved passwords, access online banking, install genuine malware, or demand payment to 'remove' the infections they claim to have found.

If you download the tool, you are installing malware directly. This may operate silently in the background, harvesting credentials and financial data over time.

Some scareware variants use browser full-screen mode to simulate a system-level lockout, making it feel as though your computer — not just a browser window — has been compromised.

Scareware exploits two powerful psychological forces: fear and urgency. An unexpected warning that your device is compromised triggers an immediate threat response — you want to fix the problem before it gets worse. The countdown timer and alarm sounds amplify this by creating artificial time pressure that discourages calm, rational evaluation.

The design of the warning borrows legitimacy from the visual language of genuine operating-system notifications, making it difficult for someone who doesn't know what a real alert looks like to identify the fake. Many people also hold an implicit assumption that 'my computer told me this, so it must be true' — scareware is designed to impersonate the computer itself.

Finally, the call-to-action is presented as a solution rather than a threat. You're being offered help, and the cost of inaction (losing your data, being hacked) appears much worse than the cost of compliance (paying for software or calling a number).

A person browsing a free streaming or download site encounters a pop-up that fills the screen with a warning claiming multiple viruses have been detected. The page plays an alarm sound and shows a 'scan' animation. A timer counts down from 60 seconds. The person, alarmed, calls the phone number displayed. A caller posing as a technician asks them to install a remote-access tool. Once connected, the caller navigates to a command prompt and shows the person normal-looking system logs, claiming these are proof of infection. The caller requests payment for a 'clean-up service'. After payment, the caller disconnects. The person later discovers their banking app was accessed during the session.

WARNING: 5 viruses detected! Call [phone number] now or your data will be permanently lost.

Your PC is infected with spyware. Purchase [software name] immediately to protect your files — EXPIRES IN 2:00.

MICROSOFT ALERT: Unusual activity detected on your device. Do not restart. Call [phone number] for support.

Security scan complete: 3 critical threats found. Download the removal tool at [fake link] to clean your device.

Your subscription to virus protection has expired. Renew now at [fake link] or your device will remain unprotected.

Action required: Your device is sending error reports to our servers. Call [phone number] to stop the attack.

The most reliable test is to remember that no website or advertisement can scan your computer. A pop-up claiming to have found viruses is always false — this is technically impossible from within a browser window.

If you are uncertain whether a security warning is real, close your browser entirely (using the taskbar or force-quit) rather than interacting with the pop-up. A real operating-system warning will remain; a scareware page will disappear.

To check your device's actual security status, open the security software you chose and installed yourself — not anything prompted by the warning. On Windows, you can use Windows Security (built in); on Mac, the system has its own malware protection.

If you want to verify whether a security product is legitimate, look it up on a reputable tech publication or consumer advice site before buying or installing it. Legitimate products do not distribute themselves through alarming pop-ups.