Scareware is a scam that frightens you with a fake security alert, such as a pop up claiming your computer is infected, so you pay for worthless software, install malware or call a number and give a stranger remote access. Close the page without interacting, run a scan from a trusted tool, and change passwords if you gave anything away.
How does scareware work?
The mechanism is psychological. A web page or ad displays a loud warning with a countdown, flashing icons and a phone number or a download button. It may mimic your operating system's alerts and try to lock the browser in full screen mode. The message says you must act now.
CISA describes phishing as criminals trying to get people to open harmful links, emails or attachments, and its checklist applies here too: urgent language and demands for money or personal information are the tell. Scareware is the same pattern delivered through a pop up instead of an email.
What happens if you follow the instructions?
There are three common outcomes. You pay for a program that does nothing, and your card details are now with a scammer. You install something that is itself malicious, such as a remote access tool or a password stealer. Or you phone the number and a fake support agent asks you to install remote control software, then claims to find problems and asks for payment.
The first outcome costs money, the second can cost accounts and data, and the third can give a stranger full control of the machine while you are logged in to your bank.
Constructed example: the pop up on a recipe site
A user is reading a recipe when a full screen alert says that three viruses were found and to call a support line within five minutes. The back button seems to do nothing. The user is stuck and worried.
What is true: browsers cannot detect viruses on your computer from a web page. A genuine operating system alert does not come with a phone number to call and a countdown. The page is only a web page, and closing the browser tab or the whole browser ends it. If the window will not close, use the task manager or force quit option, and when the browser restarts, choose not to restore the previous session.
How do you remove it and recover?
- Do not click anything inside the alert, including Close buttons drawn by the page.
- Close the tab or force quit the browser, and do not restore the session.
- Check the list of installed programs and browser extensions for anything you did not choose, and remove it.
- Run a full scan with the security tool built into your operating system or one from a source you already trust.
- If you called the number or installed something at its request, disconnect from the network, remove any remote access tool and get the device checked.
- Change passwords for email, banking and any account used on that machine, from a different clean device.
- If you paid, contact your card issuer to dispute the charge and watch for follow up scams.
- Report it. CISA and the US FBI Internet Crime Complaint Center both accept reports.
How do you prevent it?
Keep the browser and operating system updated, use a pop up blocker, and be careful with ads and free software downloads. Teach staff and family one rule: your computer never asks you to phone a number from a web page. Browser extensions should come only from official stores, and any extension that asks for permission to read all sites deserves scrutiny.
Quick check
Can a website really tell that my computer has a virus?
No. A web page has no way to scan your files. A warning that claims otherwise is a scam.
I called the number. What now?
Disconnect the device from the network, remove any remote access program the caller had you install, change your passwords from another device and contact your bank if you shared payment details.
Sources
- CISA, Recognize and Report Phishing
- CISA, Avoiding Social Engineering and Phishing Attacks
- FBI Internet Crime Complaint Center
Last reviewed: 18 October 2026.
