A fake alert with a phone number. Nothing is wrong with your device; the call exists to sell you a repair or to take remote control of it.
The page fills the screen, sometimes with sound, and tells you that a virus was detected and that you must call a number immediately or lose your files.
The alert is the product. Nothing on your machine reported it — a web page drew it. The number leads to someone whose job is to make you believe the diagnosis.
What happens after you call
- They ask you to open the system log or a developer console and read out entries that are normal on every computer, then present those entries as proof of infection.
- They ask you to install remote-support software, which gives them control of the machine and lets them move files and install things without asking.
- They offer a fix for a fee, and the fix is either nothing or software you could install free.
- The higher-risk version does not sell anything: it stays in your browser session, reads what you type, and empties accounts while you watch the repair.
Why the alert is never real
- A website cannot scan your computer. Your browser does not give it access to your filesystem.
- Antivirus software does not warn you through a web page, and never with a phone number and a countdown.
- Operating-system makers do not call, pop up or email you about an infection on your device.
- The page usually fights the close button — that is the tell.
If you already let them in
- 1Disconnect from the internet, which stops any session still running.
- 2Remove the remote-access application from your installed programs.
- 3Change the passwords for your email and your bank from a different device, starting with email — it is the key to every reset link.
- 4Check your bank and card statements for charges you do not recognise, and dispute anything you paid them.
- 5Run a full scan with software you obtained yourself, from the vendor's own site, and consider a clean reinstall if they had control for more than a few minutes.
Frequently asked questions
The alert mentioned my internet provider and my town. How?
Web pages can read your network address, and network addresses map to regions and providers. Nothing about that requires access to your device.
They showed me files with scary names on my own computer. Were those not viruses?
Those are normal system files and log entries. They are the prop: the call works only if something on your screen can be shown and renamed as evidence.
I paid by card for the 'repair'. Can I get that back?
Often yes, if you act quickly. Call your bank, describe it as a fraudulent service charge, and ask about a chargeback. Keep the receipt and the number they called from.
Written by The BaitScan team
Last updated September 16, 2026
Results are automated risk estimates based on public indicators and heuristics.