Screen Locked by a Fake Virus Warning? How to Close It and Avoid the Scam

A full screen warning appears. Your computer is infected. An alarm sounds and will not stop. A countdown says your files will be deleted. Every time you try to close it, another window opens. And there, in big letters, is a phone number for "Microsoft Support." Take a breath. Your computer is fine. Nothing is locked, nothing is being deleted, and two keys on your keyboard will make the whole thing disappear.

What you are looking at is a web page. It runs a small script that opens windows faster than you can close them and requests full screen mode, which feels exactly like being locked out. It is not. Closing the browser ends it instantly. The danger is not the pop-up itself. The danger is the phone number, because the people who answer it are tech support scammers who steal hundreds or thousands of dollars from callers every day.

This guide shows you how to close the warning in seconds on Windows, Mac, iPhone and iPad, how to stop it coming back, how to recognize every version, and exactly what to do if you already called the number or let someone into your computer.

Close it right now: the two key fix

Do not click anything on the page, including the X, "OK" or "Cancel" buttons. Those buttons belong to the web page, not to Windows or your Mac, and clicking them can open more windows or start a download.

On Windows

1. Press Ctrl, Shift and Esc at the same time. Task Manager opens.
2. Find your browser in the list: Chrome, Edge, Firefox or whichever you use.
3. Click it, then click End task.

If Task Manager does not appear, press Ctrl, Alt and Delete, then choose Task Manager. As a last resort, hold the power button until the computer turns off. That will not harm your files.

On a Mac

1. Press Command, Option and Esc together.
2. Select your browser, such as Safari or Chrome.
3. Click Force Quit.

On an iPhone or iPad

Swipe up from the bottom of the screen and pause, then swipe the browser app up and off the screen to close it. On older devices with a home button, double press the button and swipe the browser away.

On an Android phone or tablet

Open the recent apps view, usually by swiping up and holding or tapping the square button, then swipe the browser away.

That is the whole fix. The warning is gone.

What is a fake virus pop-up?

A fake virus pop-up, sometimes called a scareware or tech support pop-up, is a web page designed to look like a security warning from Microsoft, Apple, Windows Defender, Norton, McAfee or your internet provider. It claims your computer is infected, hacked or locked and tells you to call a support number right away.

The page has no real access to your computer. It cannot scan your files, see your passwords or delete anything. Its only job is to frighten you into making that phone call. Once you call, a real person working for a scam operation takes over, and that is where the money is lost.

This scam is closely linked to the cold call version, where someone phones you pretending to be Microsoft. We cover the full call script in our guide to Microsoft tech support scams.

How common is this scam?

The FTC changed its rules specifically because so many victims now call the scammers themselves after seeing a fake pop-up. Its March 2024 alert warned that these schemes no longer stop at a few hundred dollars for fake repairs. They escalate into convincing people to move their savings.

If the warning comes back

Some browsers reopen your last tabs automatically, which brings the warning straight back. Here is how to stop that.

1. Hold the Shift key while opening the browser on Windows to stop some browsers restoring tabs, or turn off your internet connection before reopening it.
2. Once the browser is open, go to Settings.
3. Find Privacy or Clear browsing data.
4. Tick cached images and files and cookies.
5. Clear, then close and reopen the browser.
6. In settings, set the browser to open a new tab page on startup instead of continuing where you left off.

Microsoft gives the same guidance in its support answers, noting that fake alerts often come back through cached pages and that clearing browser data stops them.

The one rule that identifies every version

The FTC states it plainly: security pop-up warnings from real tech companies will never ask you to call a phone number. Microsoft says the same. Real Windows errors do not show phone numbers and do not ask you to call support.

That rule matters because the warnings are designed to look convincing, and they keep getting better. You do not need to compare logos or check error codes. Just look for the phone number.

Why it feels so real

Everything on that screen exists to stop you from thinking clearly.

• The logo and colors. The page copies the exact design of a Windows, Microsoft Defender or Apple alert, including official looking error codes.
• The alarm that will not mute. Real system warnings are silent. The sound is there only to scare you.
• The robotic voice. Some pages read the warning aloud to make it feel urgent and official.
• The countdown timer. Nothing on your computer runs on a countdown. It is there to rush you.
• "Closing this window will cause permanent data loss." A web page cannot delete your files. It has no access to them.
• Full screen with no visible way out. A page can request full screen. That is a browser feature being misused, not a lock.
• Your IP address or city shown on screen. Every website can see this. It proves nothing about hacking.

None of these reflect how a real operating system behaves. They are pressure, nothing more.

Where the pop-up came from

Usually not from anything you did wrong. The most common route is a bad advertisement on an ordinary website. Ad space is bought and sold automatically, and criminals buy it like anyone else. A normal news, recipe or weather site can show one of these without knowing.

Other routes include:

• Mistyping a website address and landing on a lookalike domain
• Clicking a link in an email or text message
• Clicking a search ad that leads to a fake support site. We explain this trick in our guide to scam ads in Google search results.
• A browser extension that turned malicious after an update
• Allowing notifications from a website, which then sends fake alerts to your desktop

Seeing the pop-up does not mean you have a virus. It means a web page loaded.

What happens if you call the number

This is where the actual loss happens, and it follows a fixed script.

1. They establish authority. "Microsoft Technical Support" or "Apple Security Center." They may give an employee ID or case number.
2. They show you "proof." They ask you to open Event Viewer on Windows or Console on a Mac. Both always show routine warnings on every computer. They call these proof of infection.
3. They ask for remote access. You are told to install AnyDesk, TeamViewer, UltraViewer or a similar tool. These are real business programs, which is why the names check out when you look them up.
4. They run fake scans. They type commands that print ordinary system information and describe it as viruses or hackers.
5. They ask for payment. A few hundred dollars for a "security package," or much more for a "lifetime plan."
6. They move on to your bank. Newer versions claim your bank account is compromised and tell you to move your savings to a "safe account," buy gold, or hand cash to a courier.

A typical case, start to finish

This example follows the pattern described by the FTC and our readers' reports. The details are typical rather than taken from one single victim.

A retired engineer is reading a news article when the screen goes black and red, an alarm blares and a voice says, "Windows has detected a Trojan virus. Do not shut down your computer." The page shows a number for Microsoft Support. He knows computers, but the alarm is loud and the countdown is ticking, so he calls.

A calm agent named "Michael" walks him through installing a support tool. He shows him a screen full of red warnings in Event Viewer and says hackers have been in the computer for weeks and may have accessed his bank. He offers to "connect him to the bank's fraud department." A second person, claiming to be from the bank, says his accounts are compromised and his savings must be moved to a new protected account today.

Over two days, he wires $48,000 to that "protected account." When his daughter visits on the weekend and asks about the new software on his computer, the story falls apart. The money is gone.

The whole loss started with a web page that two keys could have closed.

The most common versions of the fake alert

The design changes all the time, but most fake alerts fall into a handful of types. Knowing them makes the next one easy to spot.

The fake Windows Defender or Microsoft Security alert

A blue or red screen copies the look of Windows Security and says a Trojan, spyware or "Zeus virus" was found. It often lists fake file names and a support number. Real Windows Security alerts appear in the corner of your screen as a small notification and never include a phone number.

The fake Apple or iCloud alert

Mac and iPhone users see a gray Apple style box saying their iCloud has been hacked or their device is infected. Apple does not show phone numbers in security warnings and does not use browser pop-ups to report viruses.

The fake antivirus subscription warning

A pop-up says your Norton or McAfee subscription has expired and your computer is now unprotected, or that a scan found 5 threats. It pushes you to "renew now" on a fake page or call a number. Check your real subscription by opening the antivirus program you installed, not by clicking the warning.

The fake browser lock

The page goes full screen, hides your mouse pointer and blocks right clicks. It may say your browser was locked by the FBI or police for illegal activity and demand a fine. No law enforcement agency locks browsers or collects fines this way.

The fake notification spam

If you once clicked "Allow" on a website's notification request, it can send desktop alerts that look like system warnings even when your browser is closed. Remove the site in your browser's notification settings and the alerts stop.

The fake search result or ad

Some people never see a pop-up. They search for "Microsoft support" or "printer help," click the first ad, and land on a fake support site with a phone number. Always type the company's address yourself.

Different look, same trap. Every version wants one thing: for you to call the number.

Helping a parent or grandparent with this

Older relatives are often the ones who call these numbers, usually because the alarm frightens them and they do not want to "break" the computer. A little preparation helps more than a lecture.

• Show them the two key fix on their own computer, and practice it once on a harmless web page.
• Tape a note to the monitor: "Phone number on a warning means fake. Close it and call me."
• Make sure Windows updates and Microsoft Defender are turned on.
• Remove any toolbars or extensions they do not use.
• Tell them it is always okay to unplug the computer or hold the power button if they panic. It will not hurt anything.

Red flags of a fake security alert

• A phone number on the screen. The single clearest sign.
• A loud alarm or voice that keeps playing.
• A countdown timer or threat of permanent data loss.
• The warning appeared in your web browser, not as a normal system notification.
• It claims to be from Microsoft, Apple, Windows Defender or your bank and urges you to call.
• The X button does not close it or opens more windows.
• It tells you not to restart or shut down your computer.
• It shows your IP address or location as "proof" of hacking.

Real security alert vs fake pop-up

How to stop these pop-ups coming back

1. Keep your browser and operating system updated. Turn on automatic updates. Modern browsers block many scam pages before they load.
2. Use Microsoft Defender or a reputable antivirus with web protection switched on.
3. Block website notifications. In your browser settings, turn off notification requests or remove sites you do not recognize.
4. Remove browser extensions you do not use or do not remember installing.
5. Be careful with search ads. When looking for support, type the company's real address yourself instead of clicking an ad.
6. Consider an ad blocker from a well known developer, since bad ads are the most common source.
7. Write the two key fix on a note by your computer. Our free printable scam safety card has space for it.
8. Teach your family the one rule: phone number on a warning means fake.

Already called and gave access? Do this now

Act in this order. The first two steps matter most.

1. Disconnect from the internet. Unplug the network cable or switch off Wi-Fi. This ends their session immediately.
2. Change your passwords from a different device, not the affected computer. Email first, then banking, then everything else. Turn on two step verification.
3. Call your bank and card issuers on the number on your card if you paid, shared card details or logged into banking while they were connected.
4. Uninstall the remote access software they had you install.
5. Run a full scan with Windows Security. Microsoft also offers the free Microsoft Safety Scanner and Microsoft Defender Offline for a deeper check. If unsure, take the computer to a local technician you found yourself.
6. If you paid with gift cards, call the card company immediately with the card numbers.
7. Report it at ReportFraud.ftc.gov and, if money was lost, at IC3.gov.

If you are 60 or older, the National Elder Fraud Hotline at 1-833-FRAUD-11 (1-833-372-8311) can help. Our guide to the first 48 hours after a scam explains what to say to your bank, and our fraud help resources page lists more contacts.

The bank and refund follow up scams

Pop-up scammers often hand victims to a second team posing as a bank or government agency. They may say your accounts are being used for crime and you must move money, buy gold, or give cash to a courier. Our guides to tech support scams that empty bank accounts and fake bank callers who send couriers cover this escalation.

Months later, a "refund department" may call saying you are owed money back and need to allow remote access again. It is the same scam. Others pose as recovery services, which we cover in our guide to recovery scams that target past victims.

If you help an older relative with technology, our tech support scam guide for seniors has extra tips written for them and their families.

Frequently asked questions

How we researched this article

This guide is based on guidance from the Federal Trade Commission and Microsoft, the FTC's December 2025 report to Congress on older consumers, and scam reports from our readers. Every statistic links to its original source. We do not accept payment from any company mentioned here. If you spot an error, please email [email protected] and we will review it under our fact checking policy.

This article is for general consumer education and is not legal or financial advice. If you have lost money, contact your bank, the FTC and the FBI.