How to spot fake antivirus warnings and pop-ups
What fake virus warnings look like, and why a phone number is the tell.
What it looks like
Microsoft says fake error messages usually come from a malicious or compromised website. It says your screen may fill with scary messages that tell you to call a phone number right away.
The phone number is the tell
Microsoft says "real error messages from Microsoft, or other big tech companies, never include phone numbers for you to call them."
If a pop-up will not close
Microsoft says to close your browser right away, and to restart your computer if you cannot close it.
Calls you did not expect
Microsoft says it will not call you to offer tech support unless you contact it first. It says to hang up on unsolicited tech support calls.
Fake updates
Microsoft says some malware is disguised as a browser update. It says to close the message and check for updates from your browser's own Help or About page.
Fake antivirus in the browser
CISA says adware pop-ups in your browser "may disguise themselves as antivirus software," and to use extreme caution with a browser alert that urges you to click to enable antivirus scanning.
Alarm emails
CISA says emails claiming the "worst virus in history" has been detected are usually hoaxes, and that you can confirm malware information through your antivirus vendor.
Buying from a pop-up
Do not buy security software from a pop-up or a call you did not expect. Go to the vendor's own site yourself.
This is general information, not security or technical support advice.
Sources: Microsoft Support, Protect yourself from online scams and attacks; CISA, Understanding Anti-Virus Software (archived); CISA, Ensure Your OS Antivirus and Anti-Malware Protections are Active.
FAQ
Next: phishing basics
Urgency, links, and odd addresses.
