A sudden warning fills your screen: "Your PC is infected! Call this number now." Your first instinct is to panic, and that is exactly what the scammer wants. Fake virus alerts are among the most common online scams, and knowing what they really are can save you from losing money or handing over control of your computer. Here is how to spot them and what to do next.
How the scam works
Fake antivirus scams follow a predictable script. The goal is not to infect your computer — it is to make you believe it is already infected and then charge you for a fake fix.
The scam has three stages:
- The trigger. A pop-up, a browser redirect, or a full-screen alert appears suddenly, claiming your computer is infected. The warning uses official-looking logos and urgent language: "Your computer has been locked", "Virus detected — call immediately", or "Your personal data is at risk".
- The call. The number on the warning screen connects to a call centre, where a "technician" tells you your computer is full of malware. They offer to fix it for a fee — typically $100 to $500 — or ask for remote access to your computer.
- The fake fix. If you pay, the scammer either does nothing, installs software that reports fake problems, or steals personal information from your computer. If you grant remote access, they can install real malware, steal passwords, and access your accounts.
The variations
- Phone call version. A caller claims to be from Microsoft, Apple, or your internet provider, saying they detected a problem with your computer. They guide you to a website that shows fake error logs and offer to fix it for a fee. This is covered in more detail in our tech support scams guide.
- Download version. The pop-up offers to "scan" your computer for free, then reports dozens of fake infections and demands payment to clean them. The "scan" is a fake — it always finds problems.
- The "subscription" version. You are asked to pay for a "security subscription" that renews monthly. The software either does nothing or actively reports fake problems to keep you paying.
The one thing that defeats every version
A web page cannot scan your computer. Pop-ups that show a "scan" progress bar are fake. The bar is a graphic that plays automatically and always ends with "threats found". Close the tab or force-quit the browser. Nothing on your computer changes.
What to do if you see a fake virus alert
- Do not call the number. The number on the warning screen is the scammer's call centre. Calling it confirms your phone number is active and makes you a target.
- Do not click anything on the warning screen. Do not click "OK", "Close", or "Scan". Clicking can trigger a download or redirect.
- Close the browser. On Windows, press Ctrl+Alt+Delete and open Task Manager. Find your browser in the list, right-click it, and choose "End task". On Mac, press Command+Option+Escape, select your browser, and click "Force Quit".
- Reopen the browser. If the warning reappears, your browser's start page has been changed. Reset it to your preferred page.
- Run a scan with your real antivirus software. If you do not have one, Windows Defender (built into Windows) is sufficient.
What to do if you already called the number
If you called the number or allowed remote access, act quickly:
- Disconnect your computer from the internet. Unplug the ethernet cable or turn off Wi-Fi. This stops the scammer from accessing your computer remotely.
- Run a full antivirus scan with your security software. If you do not have one, use Windows Defender or a free tool like Malwarebytes.
- Change your passwords from a different device (a phone or another computer). Start with your email account, then banking, then social media.
- Enable two-factor authentication on every account that offers it. Our two-factor authentication guide covers the setup.
- Contact your bank if you provided payment details. Ask them to monitor for fraud and consider freezing or replacing the card.
What to do if you paid
If you paid the scammer by credit card, contact your card issuer and dispute the charge. If you paid by gift card, wire transfer, or cryptocurrency, the money is almost certainly gone — report it to the FTC and the FBI IC3.
How to avoid fake antivirus scams
- Use a real antivirus. Windows Defender is free, automatic, and reliable. It is the only antivirus most people need.
- Block pop-ups in your browser. Most browsers block pop-ups by default. If you see a full-screen warning, it is a rare exception — treat it as suspicious.
- Keep your browser and system updated. Updates patch the security holes that fake alerts sometimes exploit.
- Use a tool like Scam Guard for real-time protection against scam and phishing websites.
Quick answers
What is a fake antivirus scam? A pop-up or phone call that falsely claims your computer is infected and demands payment for a fix. The "fix" is either nothing, a fake program, or remote access to steal your data.
Can a web page scan my computer? No. A web page cannot scan your computer for viruses. Any pop-up that shows a progress bar finding threats is fake.
What should I do if I see a fake virus alert? Do not call the number, do not click anything, and close the browser using Task Manager. Run a real antivirus scan afterward.
What should I do if I already paid the scammer? Contact your card issuer to dispute the charge, change your passwords, enable two-factor authentication, and report it to the FTC and FBI IC3.
Sources and further reading
Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.