Margaret had been retired for six years and was on her laptop looking up a lemon chicken recipe on a Tuesday afternoon when her entire screen went dark. Then a window filled it — a Windows logo, red and white text, a blaring alarm sound repeating through her speakers. The text said: VIRUS ALERT FROM MICROSOFT — Your computer has been blocked. Do not shut down or restart your computer. Call Microsoft Support immediately. Below it: a 1-800 number.
She tried clicking elsewhere. Nothing happened. She tried closing the browser. The window didn’t move. The alarm kept going. She was 68 years old, retired from teaching middle school in Columbus, Ohio, and her laptop had everything on it — photos, emails, her bank login saved in the browser. She was terrified.
She called the number.
By the end of that afternoon, a man who introduced himself as “David from Microsoft Senior Support” had walked her through downloading a program called AnyDesk. He watched her type in her banking password. He moved money between her accounts to show her it had been “hacked.” Then he convinced her to drive to two different CVS locations and buy Google Play gift cards totaling $3,400. She read the codes from the backs of the cards over the phone. The call lasted four hours.
The alarm had been a JavaScript audio loop running in her browser. The popup was a web page. Microsoft had nothing to do with any of it.
The short answer. A tech support scam popup is just a web page pretending to be a system alert. Your computer is not infected, not blocked, and not encrypted. Microsoft and Apple never put a phone number in a security warning, and they never call you first. Do not call the number. Mute your speakers, press Escape, then close the browser (Ctrl+Shift+Esc on Windows, Command+Option+Esc on Mac). If you already called and gave remote access, disconnect from the internet, change your passwords from another device, and call your bank. Never pay tech support in gift cards.
What the popup actually is
The browser-based tech support scam popup is one of the most effective social engineering tricks ever deployed at scale. Not because it is technically sophisticated, but because of what it does to your nervous system in the first thirty seconds.
The technical construction is straightforward. A malicious or compromised web page — sometimes reached through a rogue ad served on a completely legitimate site — runs a short piece of JavaScript. That script opens the page in fullscreen mode, starts an audio loop, and in some implementations locks the browser’s keyboard focus so that pressing Escape appears to do nothing. On certain older browsers, it calls alert() or confirm() dialogs in a loop that keep popping back up every time you dismiss them. The page is styled to mimic Windows or macOS system alerts, complete with official logos, official fonts, and official language.
The result looks exactly like a system-level message. Because it fills the entire screen. Because it has the Windows logo or the Apple logo. Because it says “Microsoft” or “Apple Support.” And because it’s making noise.
Here is what’s actually happening: your browser is open. A web page is displayed in it. That is the entire technical situation. Your computer is not blocked. Your files are not encrypted. You do not have a virus. The page is lying to you.
Closing the browser is always possible, even if the popup makes it feel impossible. Press Escape first — this exits fullscreen on most browsers. If that doesn’t work, press Ctrl+Shift+Esc on Windows to open Task Manager, click on the browser, and select End Task. On a Mac, press Command+Option+Esc to force quit the browser. If the alarm is blaring and you can’t think, mute your speakers first, then deal with the screen. The moment the sound stops, the emergency feeling drops significantly. That’s not a coincidence — the audio is there specifically to prevent clear thinking.
You can also just close your laptop lid. Nothing will happen to your computer.
Why it works: the alarm is the product
The specific combination of elements in a tech support popup is designed to trigger a fear response before the conscious mind can evaluate what it’s seeing. Loud alarm. Bright red. The word BLOCKED. Official logos. A phone number.
The alarm is the most important component. Studies on threat perception consistently show that auditory alarms cause an immediate physiological stress response — elevated heart rate, narrowed attention, reduced analytical thinking. Advertisers and UI designers have known for decades that an unexpected audio cue commands attention in a way that visual cues alone cannot match. The scammers know this too.
The “BLOCKED” framing is deliberate. It implies loss of control, loss of access, an emergency requiring immediate action. Compare it to a message that said “we detected a potential issue” — that’s evaluable, manageable, not urgent. “YOUR COMPUTER HAS BEEN BLOCKED” is designed to collapse the gap between “I see this” and “I need to call that number now.”
And the logos work because most people have never thought about what a real Microsoft communication looks like. They’ve interacted with Windows for decades. They’ve seen Windows logos. When a Windows logo appears alongside a message claiming to be from Microsoft, the association feels legitimate. It isn’t. Microsoft does not communicate with users through browser popups. Microsoft does not include phone numbers in system security alerts. If Windows detects a genuine security problem, it surfaces that through the Windows Security Center, through Windows Update notifications, or through official email to your registered Microsoft account. A browser popup with a phone number is not any of those things.
The phone call: what happens after you dial
The call center you reach when you dial one of those numbers is typically operating out of India, though operations have also been documented in Eastern Europe and Southeast Asia. The agents are trained, follow scripts, speak professional English, and know exactly how to handle a frightened caller.
The opening is warm and reassuring. “Thank you for calling Microsoft Support. I understand you’re having an issue with your computer — don’t worry, we’re going to take care of this.” The agent introduces themselves with an anglicized name. They ask a few questions designed to confirm you’re reachable and engaged.
Then they ask you to download a remote access tool. The most commonly requested are AnyDesk and TeamViewer — both legitimate pieces of software used by real IT departments around the world. The scammer asks you to visit a URL, download the software, and read them the connection ID it displays. Once you do, they have full control of your screen. They can see everything you do. They can move your mouse, open programs, and type — all while you watch.
What follows is pure theater, designed to prove to you that your computer has been compromised.
First, they open Event Viewer — a built-in Windows utility that logs system activity. They click into “Windows Logs” and show you entries marked with yellow warnings or red errors. “You see all these critical errors? These are caused by the virus on your system.” What they’re showing you are normal Windows logs. Every Windows machine generates thousands of these entries. They’re not errors in any meaningful sense — they’re routine system notifications, background service stops, update checks. But they look alarming to someone who has never opened Event Viewer before, and the scammer’s confident narration makes them sound catastrophic.
Next, they open a command prompt and run netstat -ano, which displays all active network connections. “You see these foreign IP addresses? Hackers have connected to your computer from China, from Russia. We can see them in real time.” What netstat shows is your computer’s active network connections. That includes connections to update servers, cloud sync services, browser background processes, and anything else running on your machine. This is completely normal. The scammer reads off IP addresses in other countries and presents them as intruder activity.
Some operations go further and run a fake antivirus scan — either a scripted animation or a legitimate tool configured to exaggerate results. The scan reports hundreds of “infections.”
By the end of this performance, many victims are convinced. Their computer is compromised. Only this Microsoft technician can save them. The price for “lifetime protection” or “complete removal service” is typically $299 to $499, sometimes more.
How they get paid — and why gift cards
Payment collection is where the scam shows its nature most clearly, because no legitimate technology company asks for payment in gift cards.
The most common method: the scammer sends you to a pharmacy or electronics store to buy gift cards, such as Google Play, Apple, Best Buy, Steam, or eBay. Amounts are usually broken across multiple cards at multiple stores. That partly stays under amounts that trigger store-employee warnings. It also spreads the purchase, because some stores now post gift-card fraud alerts near the registers.
Once you’re back from the store, you read the codes from the backs of the cards over the phone. Those codes are immediately redeemed by the scammer or their associates. The cards are gone. There is no recourse. Gift cards are functionally cash — they’re not reversible, they’re not traceable to a recipient, and they’re not covered by fraud protection the way credit card charges are.
Wire transfers are increasingly used for larger amounts. Some operations direct victims to cryptocurrency ATMs. The refund scam variant, which we’ll get to shortly, often involves bank transfer.
The FTC reported that Americans lost $924 million to tech support scams in 2023 — making it one of the largest fraud categories by dollar volume. That figure represents only reported losses. The agency estimates actual losses are significantly higher, because many victims, particularly older adults, don’t report out of embarrassment.
The cold call variant: no popup required
Not every tech support scam starts with a browser popup. The cold call variant skips the browser entirely and calls you directly.
The pitch is consistent: “Hello, I’m calling from Microsoft Windows / Apple Support / your internet service provider. We’ve detected that your computer is sending error reports to our servers, which indicates it may be infected with a virus. We’re reaching out to affected customers to help resolve this.”
These calls are entirely fabricated. Microsoft does not monitor your computer for errors and call you about them. Apple does not proactively call customers about security issues. Your ISP does not refer you to third-party technicians to fix viruses on your machine. No company operates this way. The calls are cold-dialed, using phone number lists purchased from data brokers or generated by random dialers.
The script that follows is nearly identical to the popup variant. The scammer asks you to sit at your computer. They guide you to press Windows+R to open the Run dialog, then type eventvwr to open Event Viewer. They walk you through the same performance: look at these errors, these are signs of infection, hackers have connected to your machine. The phone call creates the same urgency that the popup alarm creates — you’re already on the line with “Microsoft,” so the scenario feels real.
From there, the remote access request follows. Download AnyDesk. Read me the connection ID. And the script continues from there.
Phone numbers used in cold call campaigns are obtained in a few ways. Data broker databases that list name, phone number, and age are one source. They’re inexpensive to buy and often accurate. Older voter registration records, property records, and public directories end up in these datasets. This is the same pipeline covered in how scam callers know your name. Some operations use predictive dialers that simply call every number in a given area code. The scammer doesn’t know who they’re calling until someone picks up.
The refund scam: the most financially devastating variant
If the popup scam and the cold call are the first-generation approach, the refund scam is the evolved form. It’s more complex, more convincing, and responsible for some of the largest individual losses.
The setup: you receive a call or email claiming that a subscription has been automatically renewed, often for a large amount of $299 to $499. It might be your Microsoft support plan, your Norton antivirus, or a “computer protection service.” The message says you’re entitled to a full refund because you “no longer use the service.” All you need to do is let them process it.
This variation is effective precisely because the scammer isn’t immediately asking you for money. They’re ostensibly giving you money back. That framing lowers defenses.
Once they have remote access to process the “refund,” the scammer opens your online banking site. They instruct you to look away or they cover the screen briefly. What they’re actually doing is either moving money between your own accounts (from savings to checking) or using browser developer tools to modify the balance number displayed on screen. When you look back, the balance has “increased” by, say, $4,000 — representing the supposed refund.
“Oh no,” the scammer says. “I made an error — I accidentally processed a refund of $4,000 instead of $299. I’ll lose my job over this. Please, can you send back the difference?”
The victim now sees what appears to be $4,000 in their account. Feeling sympathetic toward the agent who’s been helpful for the last hour, they agree to send back $3,701. Payment goes by wire transfer, gift cards, or increasingly through cryptocurrency ATMs.
No money ever arrived. The $4,000 “increase” was either a visual manipulation or money moved from the victim’s savings account. The victim just sent $3,701 of their own money to a scammer.
The FTC identified this specific variant as responsible for $59 million in losses in 2023 alone. Because the “transfer back” appears to come from the victim voluntarily, banks often resist fraud claims — technically, the victim initiated the wire.
Who gets targeted, and why age matters
Adults over 60 account for more than half of reported tech support scam losses. The FTC’s data shows that adults 60 and older are five times more likely to lose money to tech support scams than adults aged 18 to 29.
This is frequently misread as a statement about technical literacy or intelligence. It isn’t. The targeting is rational and based on several factors that have nothing to do with intelligence.
First, availability. Retired adults are more likely to be home during business hours when cold call campaigns run. Working-age adults who might be targeted are often away from their computers or distracted by other demands.
Second, familiarity with the scenario. Adults who are now in their 60s and 70s grew up calling technical support lines. They’ve had experiences where calling a number solved a computer problem. The call center model is not foreign to them — it’s how they’ve interacted with technology companies before. When a scammer presents as tech support, the mental model fits something they’ve done legitimately.
Third, the stakes. Older adults are more likely to have accumulated savings, to have those savings in accessible bank accounts, and to be anxious about protecting them. The combination of a frightening warning and the offer of protection is particularly effective when the person has real assets to lose.
The scammers know all of this. Call center scripts include guidance on identifying and continuing to engage older callers. Victims are sometimes contacted again, occasionally by a different operation claiming to help victims of tech support scams. This is called recovery fraud, and it has its own guide: recovery scams. If you’ve been scammed once and reported it, your information may end up on a “sucker list” sold to more fraudsters. The FTC and Microsoft’s Digital Crimes Unit have both flagged this secondary targeting as a growing pattern.
Microsoft’s Digital Crimes Unit and what’s actually being done
Microsoft established its Digital Crimes Unit (DCU) in 2008 as an internal team dedicated to disrupting cybercrime at scale. The DCU has taken legal action against tech support fraud networks. That includes a 2021 court action against a network operating out of India, which had defrauded thousands of victims, primarily in the United States and Canada. Microsoft worked with the Indian Central Bureau of Investigation and Interpol on that case.
The DCU approach combines civil litigation (seizing domains and infrastructure used by scammers), referrals to law enforcement, and public awareness. In 2021, Microsoft filed civil suits against 17 defendants in the Eastern District of Virginia, identifying operations that had used fake Microsoft branding to defraud victims of millions of dollars.
The challenge is scale. The FTC receives hundreds of thousands of tech support scam reports per year. The operations are distributed, often cross-jurisdictional, and the individuals operating call centers in India can be replaced faster than legal proceedings move. Microsoft’s enforcement actions are meaningful but necessarily targeted — they disrupt specific operations rather than the ecosystem.
Law enforcement prosecutions do happen. In 2020, the Department of Justice coordinated with Indian authorities to arrest individuals connected to a network that had defrauded thousands of Americans. In 2023, a federal grand jury in Texas indicted members of a tech support fraud ring that had operated for years out of call centers in India. Sentences in US federal cases for tech support fraud have ranged from several months to over four years in federal prison.
But prosecution is rare relative to the volume of fraud. The practical protection has to come from the potential victim knowing what tech support scams look like before they encounter one.
What to do when the popup appears
The sequence matters. Do these in order, stay calm, and remember that your computer is not actually infected.
Mute your speakers first. The alarm is there to prevent rational thought. Remove it. The visual elements of the popup are much easier to dismiss without the audio component.
Press Escape. Most browser fullscreen modes exit with Escape. The popup may remain, but it will be browser-sized rather than screen-filling, which changes how threatening it feels.
Close the browser. On Windows, right-click the browser icon in the taskbar and select “Close window,” or press Alt+F4. On Mac, press Command+Q to quit the browser entirely. If neither works, open Task Manager on Windows (Ctrl+Shift+Esc) or Activity Monitor on Mac (Command+Space, type “Activity Monitor”), find the browser process, and end it.
Do not call the number. Do not click anything on the page. Do not download anything the page suggests. The number is operated by the scammers. Calling it begins the fraud process.
You may still worry that something did happen to your computer. It didn’t, but the anxiety is reasonable. Run a scan using Windows Defender (built into Windows, free, updated regularly) or Malwarebytes Free (reputable, widely used). Neither will find anything related to the popup page, because the popup was a web page, not malware. But running a scan and seeing a clean result is genuinely reassuring.
What to do if you’ve already given them access
If you gave a scammer remote access to your computer, act quickly. The window matters.
Disconnect from the internet immediately. Unplug the Ethernet cable or turn off Wi-Fi. The remote access session ends when the connection drops. Critically, the scammer may have installed a persistence backdoor — a secondary remote access tool configured to reconnect automatically when you go back online. Disconnecting before they can do this is important.
Do not reconnect on that machine yet. From a different device — your phone, a tablet, another computer — change the passwords to every account you access on that machine, starting with your email and your bank. Do not change them from the compromised computer until it has been scanned.
Run a full antivirus scan. Download Malwarebytes on a clean device, transfer it via USB, and run a full scan. Windows Defender can also run a full offline scan at startup. Look specifically for AnyDesk, TeamViewer, or other remote access tools that you didn’t install — and uninstall them.
Contact your bank if money moved. Wire fraud can sometimes be reversed if reported within 72 hours. Call the fraud department directly, explain what happened, and ask them to attempt a reversal. This doesn’t always work, but it works often enough to be worth doing immediately. Gift card payments are almost never recoverable — but report them anyway.
File a report with the FTC at reportfraud.ftc.gov. The FTC uses these reports to identify trends, support law enforcement investigations, and warn other potential victims. It takes about five minutes. Include the phone number you called or that called you, the name the agent used, and any payment details. If you’re outside the US, file with your national consumer protection agency — Action Fraud in the UK, the ACCC’s Scamwatch in Australia, the Canadian Anti-Fraud Centre in Canada.
Check for persistence. Look in Task Scheduler on Windows (search “Task Scheduler” in the Start menu) for any recently created tasks. Look in Startup programs (Task Manager > Startup tab) for anything unfamiliar. If you’re not comfortable doing this yourself, take the machine to a local computer repair shop and explain what happened. Most technicians can sweep for backdoors in under an hour.
The conversation you should have before this happens
The highest-impact action available to anyone who has read this far is a conversation — with a parent, a grandparent, an aunt or uncle, a neighbor. Not a lecture. A brief, direct explanation of three things:
Microsoft will never call you. If someone calls saying they’re from Microsoft, Windows Support, Apple, or any tech company, and you didn’t initiate the call, hang up. These companies do not proactively call customers about their computer’s security. No exceptions.
A browser popup is never a real virus warning. If a full-screen alert appears on your computer with an alarm sound and a phone number, it is a scam. Press Escape or close the browser. Do not call the number.
Gift cards are never a legitimate payment method. No government agency, technology company, utility, or bank will ever ask you to pay anything in gift cards. If someone asks you to buy gift cards to pay for anything — tech support, taxes, a fine, anything — it’s a scam. Stop, hang up, and tell someone you trust what’s happening.
Those three sentences, delivered once in the right moment to the right person, can prevent a loss of thousands of dollars and months of financial and emotional recovery. The FTC estimates that tech support scams cost American consumers nearly a billion dollars a year. Most of those losses happen because people encounter the scam without ever having heard an explanation of how it works.
You’ve heard one now. The alarm is just JavaScript. Microsoft doesn’t know your computer’s running. And that phone number goes to a call center, not Redmond.
If you or someone you know has been targeted by a tech support scam, report it to the FTC at reportfraud.ftc.gov. KnytX Shield is built to watch for your personal information in the broker databases that scammers buy for targeting, and to remove it automatically once you’re in. It isn’t live yet; join the waitlist to get in early.