Quick answer: Scareware uses alarming fake warnings or rogue security software to push you into calling, paying or installing a supposed fix. A warning on a web page does not prove your device is infected. Close it through the real browser controls, then check what access or information you gave. Running software, granting remote access, sharing a password and paying each need a different follow-up.
The aim is to respond calmly without handing the warning more access. This guide distinguishes a nuisance page or notification from a device, account or payment problem, with practical steps for each.
Match the Response to Your Exposure
Start with what you did, not the number of viruses the warning claims to have found. A page can display an invented scan, a familiar company logo or a full-screen message without examining your computer. The name scareware can refer to that scam presentation or to installed rogue software; the response depends on the actual exposure.
More than one row can apply. If you installed a remote-access app, entered a banking password and paid, closing the original page is only the first step. Device investigation, account recovery and contacting the payment provider remain separate jobs.
How These Scams Create Pressure
Scareware uses urgency to turn an uncertain warning into an immediate purchase or support call. It may claim your files will be deleted, play an alarm sound or cover the browser with an imitation system message. Polished wording and recognizable branding do not establish authenticity.
Fake Scans and Support Numbers
An invented scan can report a long list of threats almost instantly. A support number moves the scam to a conversation where someone may request remote access and reinterpret ordinary system messages as a problem. Do not let the warning’s own number become your verification route.
The FTC’s tech-support scam guidance describes bogus warnings, remote-access requests and misleading renewal messages. If you suspect a real subscription charge, check the actual bank or card record and contact the company through a known independent channel.
Scam Ads, Links and Renewal Messages
A malicious advertisement, deceptive search result or message can lead to the same page. A fake renewal email can instead lure you into a supposed refund call without showing a virus warning. Some scams layer several impersonations, so an apparent handoff to a bank or government official is not a reason to transfer money.
A download can be the next stage, but seeing the page does not establish that code ran. Take a browser or download warning seriously and leave protection enabled rather than following a stranger’s instruction to disable it.
Verify an Alert Independently
Open the security app you normally use through your device’s own controls. Review its protection status and detection history there. A message that resembles an operating-system notification can still come from a website allowed to send alerts; visual style alone is unreliable.
Clues That Deserve Caution
An unexpected security warning that tells you to call a number, pay immediately or install a new tool deserves suspicion. Full-screen presentation and countdowns add pressure. Spelling mistakes can be a clue, but correct spelling and a clean logo do not make the message genuine.
Real Warnings Can Also Need Action
A real security product can warn about a harmful file or blocked site, and a browser can show a legitimate download or certificate warning. Do not dismiss every alert because you have seen a scam before. Verify through the real app or browser controls, then follow its supported guidance. Do not turn off protection to get past a warning you have not understood.
Microsoft’s online-scam guidance explains how scam pages imitate or appear to lock the computer. The trusted response is to leave the presentation and use independent controls, not to trust its “repair” or “close” button.
What to Do After Each Kind of Interaction
You Only Viewed the Page
Close the tab or window through the browser’s own controls. On Windows, Microsoft suggests Alt+F4 if the mouse controls do not let you close the browser. Closing can discard unsaved work in that window. Avoid restoring the same suspicious page when you reopen it.
If the alert was only a page, its disappearance is useful, but it does not establish that every other device problem is resolved. A trusted scan is reasonable if you are unsure what happened or notice persistent symptoms; there is no need to buy the tool advertised by the alert.
You Allowed Website Notifications
Revoke the suspicious site’s notification permission in the browser. A notification can reappear when the original page is closed, and a malware scan may not remove a permission you deliberately granted. This differs from closing a pop-up window.
In desktop Chrome, open Settings, then Privacy and security, Site settings and Notifications; review allowed sites and block the unwanted source. Google’s notification instructions cover the current controls and separate Android workflow. Keep useful permissions for sites you recognize rather than changing every permission blindly.
You Downloaded or Ran Software
Do not open an unexpected download. Check the file and its source through trusted device controls. If you ran an installer or added an extension, use the real security app to investigate and follow its supported quarantine or removal advice. Avoid randomly deleting system files or restoring a detection merely because another page says it is safe.
You Gave Remote Access
Disconnect an unknown remote session and stop further access. Record what app was installed and what the person changed, then use trusted support to check the device if necessary. Treat credentials and payment information accessed during the session as separate exposures. For a work or school device, notify its administrator.
You Shared a Login, Code or Payment
From another trusted device, change exposed passwords, review active sessions and recovery details, and use supported two-factor authentication. A shared verification code may have authorized a sign-in or transaction, so check the affected service rather than assuming a password change reverses everything.
Contact the bank, card issuer or payment service through its real app or a known number if you paid or shared card details. Ask about the specific transaction and account-protection options; recovery depends on the payment method and circumstances. Do not pay someone promising a guaranteed refund.
Device Checks and Safe Cleanup
Investigate the device when a file ran, an app was installed, remote access was granted or symptoms persist. Ordinary security checks are still useful when you are uncertain; the rule is to use trusted controls, not to wait for a dramatic symptom or buy a pop-up’s fix.
Check Apps, Extensions and Browser Settings
Review recently installed apps and extensions, unexpected download files, altered home/search settings and allowed notification sites. Identify an unfamiliar item before removing it; a legitimate system component can have an unfamiliar name. A managed browser or device may need its administrator to change settings.
Google’s unwanted-program and browser-reset guidance separates device removal from resetting Chrome settings. A reset can change your preferences and disable extensions, so review the effects and re-enable only extensions you trust.
Use Supported Security Scans
Update your active security provider through its own controls and run an appropriate supported scan. Windows includes malware protection in Windows Security. A paid antivirus subscription is not automatically required because you saw a fake alert.
For scan and quarantine choices, see our Malwarebytes review or the documentation for your installed provider. An on-demand scanner and continuous protection are different functions. Do not run competing real-time antivirus engines together unless the vendors support the combination.
When to Seek Trusted Help
Get qualified help if detections return, security controls cannot run, important files are affected or the remote-access changes are unclear. A clean scan cannot retrieve stolen information or reverse a payment. Preserve the information needed for account or fraud reporting, without sending private files or codes to the person who displayed the alert.
Reduce Repeat Alerts and Future Exposure
Keep your browser, operating system and apps updated. Review notification permissions and use the browser’s supported pop-up and download protections. Filters can reduce exposure to known harmful sites or ads, but none establishes that every page is honest.
Download Through the Real Publisher
When you need an update or security tool, open the app’s own update controls or navigate to the genuine publisher. Do not treat an unexpected pop-up, search advertisement or “free scan” page as a trusted installer. HTTPS protects a connection; a scam page can still use it.
Make Verification Easy for the Household
Agree on a simple rule: pause, leave the warning and ask through a known contact before paying or giving access. Keep account recovery details and safe backups available. A relative should not have to identify malware terminology under pressure to avoid a support scam.
Choose protection for its supported platform and actual job. An iPhone security app does not inspect the whole system like desktop antivirus; a VPN tunnel does not remove an installed infection. What is malware? explains those distinctions.
Why a Familiar Brand or Paid Tool Is Not Proof
Scammers can impersonate real security companies in warnings and renewal messages. The appearance of a name such as Microsoft, Norton or McAfee does not establish that the company sent the message. Verify the message independently instead of accusing the real provider or trusting the impersonation.
In March 2024, the FTC described a deceptive computer-security scan case involving Reimage and Restoro. The useful lesson is to check whether a claimed problem is real before buying a repair, not to treat every current security product or ordinary notification as fraudulent.
Once you have closed the warning, finish the follow-up that matches your exposure. A revoked notification permission, checked device, recovered account and disputed payment each resolve a different part of the incident.
Frequently Asked Questions
Is scareware a virus?
The term can describe a fake security-warning scam or installed rogue software. A web-page warning is not itself proof of an infection, though its download or remote-access request can introduce further risk.
Can a website really scan my whole computer?
A page displaying a threat count does not establish that it scanned the device. Open your real security app independently and review its detection history.
Why do fake warnings keep appearing after I close the page?
The site may have notification permission, or a browser extension, unwanted app or reopened tab may be involved. Identify the cause; a scan alone may not revoke an allowed website permission.
Should I run a scan if I only saw a pop-up?
Use trusted security controls if you are uncertain or notice persistent symptoms. Do not buy or install the pop-up’s proposed fix. Running software or granting remote access calls for a more thorough device check.
What should I do if I gave a scammer a password or verification code?
Use another trusted device to recover the affected account, review sessions and recovery details, and enable supported two-factor authentication. Check whether the code authorized a sign-in or transaction.
What should I do if I paid for a fake repair?
Contact the payment provider independently and ask about that transaction and account protection. Save relevant records. Do not pay another person promising guaranteed recovery.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.