Tech-support popup: how to tell, what to do.
The warning is a web page. The number is the scam. The remote access is the damage.
Try it
Here is what Check says about one.
Example message
WINDOWS DEFENDER SECURITY WARNING. Your computer is infected with trojan spyware. Do not shut down. Call Microsoft Support now: 1-855-555-0199. Error code 0x80073b01.
These are examples. To check a message you received, create a free account: five checks a day, only the text you paste is sent.
Check my own message, freeFake security warning with a support number to call
Why we think so
- Microsoft and Apple do not show phone numbers in warnings
- An alarm, a “do not shut down” and a number to call, the pressure pattern
- The page is a browser tab, not the operating system
The short answer
Updated 23 October 2026 · Reviewed by the Sigrel team, Texas
A full-screen warning says your computer is infected and shows a number to call. What is happening, how to close it, and what to do if you gave someone access.
- A browser tab that fills the screen, sometimes with an alarm sound and a voice.
- A “Microsoft” or “Apple” support number; when you call, a technician asks to connect to your computer.
- Once connected, a fake scan that “finds” problems and a fee of hundreds of dollars.
- A later call about a “refund” that ends with a transfer out of your bank account.
What to do
In this order.
- 01Close the browser, not the computerPress Escape, or quit the browser (Alt+F4 on Windows, Cmd+Q on Mac). If it will not close, restart. Nothing on the page can damage the computer by itself.
- 02If you let someone connect, disconnect nowTurn off Wi-Fi or unplug the network cable. Then uninstall the remote-access app they had you install (AnyDesk, TeamViewer, UltraViewer and the like).
- 03Change the passwords you used while they were connectedStart with email and bank, from a different device, and turn on two-step sign-in.
- 04If you paid, call the card issuer or bankDispute the charge and watch for the “refund” call that follows. Report at ReportFraud.ftc.gov.
Behind every scan
What is checked, how often, and what you get back. The details, in plain words.
Sources
3 breach-intelligence partners and public leak lists
Each one named in Help with what it covers.
What we watch
6 kinds of identifier
Email, phone, username, gaming handle, email alias and your own domain. Hashed on your device first.
Schedule
Rechecked on a schedule you can see
Every result shows when it last ran. Daily on Pro.
What you get
A fix for every finding
The minutes it takes and the points it gets back. Broker removal across 200+ sites on Pro.
How Sigrel helps
A verdict in the moment, the fix after.
Check the message you received
Paste it; the verdict says why in two lines. Five free checks a day; the text is not kept.
See it reported in your county
The Wire lists the scams reported near you this week, dated and sourced.
If it already happened
The recovery playbooks: who to call first, what to say, what to report.
Questions
Plain answers.
Is my computer actually infected?
The popup itself is not an infection; it is a web page. Run the security software you already have. If you installed a remote-access app for the caller, remove it.
They showed me scary files and “foreign connections”. Were those real?
No. Normal system logs and network tables look alarming to anyone. Showing them is part of the script.
Got one of these right now?
Paste it into Check. Five free checks a day; the text you paste is not kept.