Safe Retire Watch logo

Tech Support Scams: Fake Pop-Ups & Refund Traps

Short answer

A tech support scam starts with an alarming pop-up, email, or call claiming your computer is infected or a subscription is renewing, and ends with a stranger controlling your screen. Microsoft, Apple, and Best Buy never display a phone number in a security warning. Close the pop-up without calling, and never grant remote access to anyone who contacted you first.

Reviewed and updated by the Safe Retire Watch Research Team.

Instant tell
A security warning that includes a phone number — real ones never do
Remote tools abused
AnyDesk, TeamViewer, UltraViewer, LogMeIn, and screen-share links
Second act
The 'refund overpayment' trick, where a faked balance convinces you to send money back
Safe exit
Close the browser or restart the computer — the pop-up is a web page, not a virus

How does a tech support scam unfold?

  1. 1A full-screen pop-up appears with sirens, flashing text, and a warning not to shut down. It is a web page designed to look like a system alert.
  2. 2You call the number. A polite technician confirms your worst fear and offers to check the machine.
  3. 3They ask you to install remote access software. Once connected, they show Event Viewer logs or a netstat window as fake proof of infection.
  4. 4They charge for cleanup, a lifetime protection plan, or a fake antivirus subscription — often several hundred dollars.
  5. 5Weeks later, a 'refund department' contacts you, claims the company is closing, and processes a refund. They edit what appears on your banking screen so it looks like too much was deposited, then ask you to return the difference in gift cards or crypto. Nothing was ever deposited.

How do I get rid of a scam pop-up safely?

  1. 1Do not call the number, and do not click buttons inside the window, including 'Close' or 'Cancel.'
  2. 2Press Escape to leave full-screen, then close the tab. On Windows, use Ctrl+Alt+Delete and end the browser task; on Mac, use Command+Option+Escape and force quit the browser.
  3. 3If audio keeps playing, restart the computer. That alone ends the vast majority of these pop-ups.
  4. 4Reopen the browser and decline to restore previous tabs.
  5. 5Clear the browser cache, and check that no unfamiliar extension was installed.
  6. 6If you already granted remote access, disconnect from Wi-Fi, uninstall the remote tool, change your passwords from a different device, and have the machine inspected before banking on it again.

What about renewal emails from Geek Squad, Norton, or McAfee?

These are the email version of the same operation. The invoice shows a charge of a few hundred dollars for a product you do not remember buying, and the only way to 'cancel' is to call their number. The goal is either remote access or the refund-overpayment routine. Verify by checking your card statement and your account on the vendor's real website. If no charge exists, there is nothing to cancel.

What should I do if I paid or gave access?

  1. 1Call your card issuer or bank fraud line and dispute the charge as fraud; report any gift card purchases to the retailer immediately.
  2. 2Change your email and banking passwords from a clean device, and enable two-factor authentication.
  3. 3Remove remote-access software and run a scan with your built-in security tool, or have a trusted technician review the device.
  4. 4Watch for follow-up calls — victim lists are resold, and the 'refund' call is the most profitable stage of all.
  5. 5Report to ReportFraud.ftc.gov and, if losses are significant, to ic3.gov.

Frequently asked questions

Will Microsoft or Apple ever call you about a virus?

No. Microsoft and Apple do not make unsolicited calls about infections, and they do not put support phone numbers in security pop-ups. Any inbound call or on-screen warning claiming your device is infected and offering a number to call is fraudulent, including ones that display your correct name or an accurate-looking case ID.

Is my computer infected if I saw a scam pop-up?

Usually not. Scam pop-ups are ordinary web pages using full-screen tricks and audio, delivered through advertising. Closing the browser or restarting the computer removes them. The real risk begins only if you called the number, installed remote-access software, or entered credentials — in that case, change passwords from another device and have the machine checked.

What is the refund overpayment scam?

After a fake tech support charge, a 'refund department' calls to return your money. With remote access to your screen, they alter what appears in your online banking display so it looks like they mistakenly sent thousands too much, then plead for the difference back in gift cards or cryptocurrency. No money ever arrived — you would be sending your own funds. Hang up and call your bank directly.

Sources and further reading

Guidance on this page is based on current advisories from these authorities.

Other scam hubs