Fake virus pop-up or 'Microsoft' call? Tech support scams

Steps

1. 01

   Don't call, don't click, don't pay

   Microsoft says its error and warning messages never include a phone number, and that it does not make unsolicited calls

   • Do not ring the number or press any button inside the pop-up
   • If you are on the phone with them, hang up — you do not owe them an explanation
   • Never let a caller connect to your PC, never read out a code, and never pay for a 'fix'
2. 02

   Close the pop-up without touching it

   • Press Ctrl+Shift+Esc to open Task Manager
   • Select your browser in the list and choose End task
   • Open the browser again — if it offers to restore your pages, say no, or the pop-up comes straight back
   • If Task Manager will not appear, hold the power button until the PC switches off, then turn it on again

   ✓You should see: Your normal desktop, and a browser that opens on an ordinary page.

   Why?

   The pop-up is a web page built to fill the screen, and sometimes to play a voice or an alarm. A web page cannot scan your PC, so nothing it says about your files is true. Microsoft notes that Edge can stop the pop-up loops these pages use.

3. 03

   If you only saw it, or only spoke to them

   • Closing the page or hanging up is enough — nothing was installed
   • Run a scan if you would like the reassurance
   • Report the page or the call to Microsoft at microsoft.com/reportascam

   Also see: Think your PC has a virus? Scan it properly

4. 04

   If you called them or let them connect, cut them off first

   • Disconnect from the internet now: unplug the network cable or turn Wi-Fi off
   • Shut the PC down and start it again, still offline
   • Uninstall anything they had you install, and check Windows' own remote settings are off
   • Reconnect, install Windows updates, and run a full scan

   !Careful: Microsoft's guidance for a device a scammer had remote access to is to reset it. If you bank, work or keep anything important on this PC, treat a reset as the normal next step rather than a last resort.

   Why?

   Shutting down ends a live session, but a tool they installed can start again with Windows. That is why removing it comes before going back online.

   Also see: Check for remote-access software you didn't install · Think your PC has a virus? Scan it properly · Reset Windows: keep your files, or start completely fresh

5. 05

   Then protect your money and your accounts

   • If you paid, or gave card or bank details: phone your bank now on the number on your card, and ask them to stop the payment and replace the card
   • Change your passwords from a different device, starting with email and banking
   • Report it to Report Fraud, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040 — it covers England, Wales and Northern Ireland; in Scotland, call Police Scotland on 101
   • Be wary of anyone who then contacts you offering to get the money back for a fee

   Why?

   Report Fraud replaced Action Fraud on 4 December 2025; the phone number, 0300 123 2040, did not change. It takes reports from England, Wales and Northern Ireland. In Scotland, report to Police Scotland on 101.

   Also see: Think someone got into your accounts? Lock them down