Legitimate Antivirus Warning vs Fake Antivirus Popup
How to tell a real security alert from a fake popup trying to get your money or remote access.
Last reviewed: 1 June 2026
Security software on a normal day is almost invisible. It updates quietly, occasionally tells you it has quarantined something, and reports what it found inside its own window or from the system tray, in flat and factual language. Fake alerts are built to feel like the opposite. They arrive as a full-screen browser page with sirens, countdowns, a list of supposed infections, and a phone number to call immediately, and they often appear after a mistyped address or an ad on an otherwise ordinary site. They work because panic is faster than reasoning, and because the branding is copied convincingly. The distinction that decides it is location: a web page cannot scan your computer. If the warning lives in a browser window and gives you a number to call, it is a scam.
Side-by-side comparison
| Real antivirus warning | Fake antivirus popup | |
|---|---|---|
| Alert location | Appears within the security software's own interface or system tray | Appears as a browser webpage or full-screen overlay |
| Phone number | Never provides a phone number to call for virus removal | Prominently displays a number to call 'immediately' |
| Payment | Subscription renewals via official account portal only | Demands immediate payment to 'remove' the virus |
| Remote access | Doesn't need you to install anything or grant remote access | Asks you to install a tool or grant remote control |
| Closability | Alert can be dismissed or addressed within the software | Designed to prevent closing; may use browser full-screen tricks |
| Urgency language | Factual, measured language describing findings | Extreme urgency: 'Your device is infected RIGHT NOW' |
Common red flags
- Security alert appearing in a browser window rather than security software
- Phone number displayed for you to call about the virus
- Payment demanded immediately to remove a detected threat
- Request to install remote-access software to fix the problem
- Unable to close the window or browser tab normally
- Extreme, panicked language designed to provoke immediate action
Verification steps
- Close the browser tab — press Alt+F4 or use Task Manager if necessary; a web page cannot actually scan your device
- Open your actual installed security software and check whether it reports anything
- Do not call any number displayed in a browser-based security alert
- Run a scan using your real, installed security software to check for any genuine issues
- Keep your operating system and security software up to date to reduce genuine vulnerabilities
What not to do
- Don't call the phone number in a browser-based popup
- Don't pay for 'virus removal' in response to a browser alert
- Don't install remote-access tools prompted by a popup
- Don't assume closing the browser tab means you were infected — you almost certainly weren't
A safe response
Take a breath. Nothing has actually scanned your machine, so there is no emergency and no reason to act in the next thirty seconds. Close the tab. If it will not close, press Alt and F4, or open Task Manager with Ctrl, Shift and Escape and end the browser, then reopen it and decline to restore the previous session. Open the security software you actually installed and run a scan from there if you want reassurance. If you already called the number, installed a tool, or let someone connect to your device, disconnect from the internet, change your passwords from another device, and contact your bank if any payment or account details were visible.
Frequently asked questions
Can a website actually detect viruses on my device?
No. Websites run inside a sandboxed browser environment and cannot scan your operating system or files. Any browser-based 'virus detected' alert is a fake designed to cause panic.
What if the popup won't close and is blocking my screen?
Use keyboard shortcuts: Alt+F4 to close the window, or Ctrl+Shift+Esc to open Task Manager and end the browser process. You can restart your browser and choose not to restore the previous session.
I called the number — what should I do?
If you didn't give remote access or payment details, you are likely fine. If you did grant remote access, see the remote-access scam recovery steps and change your passwords from a different device.