That 'Microsoft' pop-up is fake: what to do right now

That warning is fake: do not call the number, and close your browser now — if it will not close, restart the computer. When the computer comes back on, do not reopen the page if the browser offers to restore it.

What to do in the first hour

The right steps depend on what happened so far.

If you saw the pop-up and closed it, or restarted the computer:

1. A warning that only appeared in the browser is a web page. Closing it was the right move.
2. Do not call any number that appeared in the warning.
3. Do not click the back button to return to the site where it appeared.
4. Do not click any links inside the warning.
5. If you have security software already on the computer, run a scan now as a precaution.
6. Tell a trusted family member what happened, even if everything seems fine.

That is the complete list. No further action is required.

If you already called the number, or let someone connect to your computer:

That is a different situation. The steps depend on what was shared — remote access, bank details, passwords, or payment. Follow the full guide: What to do if a parent let a scammer into their computer. It covers how to disconnect remote access, remove any software the scammer may have installed, change passwords from a clean device, and contact the bank if needed.

How to tell a fake warning from a real one

The clearest sign of a fake warning is a phone number inside it. Microsoft says: "Genuine Microsoft error messages never include a phone number to call." (Microsoft)

An illustration made for this article; the phone number is fictional. The numbers mark the tells: (1) your bank and passwords "at risk right now," (2) a phone number to call, (3) "do not restart," which is the opposite of what you should do, and (4) a countdown timer.

Other signs that a warning is fake:

• A loud alarm coming from the browser
• A countdown timer saying your files will be deleted
• A screen that appears frozen and will not let you click anything
• A message saying your bank account, identity, or data is exposed right now
• An instruction to pay immediately, especially by gift card, wire transfer, or crypto

Real error messages do not use alarms, timers, or payment demands.

If someone calls you unexpectedly and says they are from Microsoft or another technology company, hang up. Microsoft says it will never reach out to you on its own to offer tech support. A real company will not mind if you call back on a number you already have — the one on their official website or on your receipt. A caller who insists you stay on the line is a scam signal.

Why these warnings are hard to ignore

The warning works because it brings three things at once: authority, fear, and a simple path out.

Authority comes from a name most people recognize — Microsoft. Fear comes from the message: virus found, files at risk, act now. The simple path out is the phone number. You do not need to understand computers to follow one instruction.

That is what the warning is designed to produce. Slowing down for even one minute — calling a family member, stepping away from the screen — can be enough to break the pattern. The urgency is a technique, not a sign that the threat is real.

How to prevent it

Prevention works best before any warning appears.

Browser settings. Your browser has built-in settings to block pop-up windows and to stop websites from sending you notification requests. Turning both on reduces how many of these warnings can reach the screen. Check the privacy or site settings in whatever browser the computer uses.

A family rule. Agree in advance: before calling any number shown in a computer warning, call a trusted family member first. Write down who to call and keep that note near the computer. That one pause can stop the scam.

Known support paths. Write down one or two trusted contacts — a family member, an IT provider — and put the note somewhere easy to find. When a warning appears, having a real phone number within reach matters. The printable fridge card has a blank for it.

Skepticism about urgency. Any message that says you must act immediately is trying to stop you from thinking. Urgency is a tactic, not a sign the threat is real. The computer will still be there after a five-minute pause.

The scale of the problem

In 2025, people aged 60 and over filed more than 21,000 tech and customer support scam complaints with the FBI's Internet Crime Complaint Center. Their reported losses were more than $1 billion. If you or someone you know has been targeted, you can file a report at ic3.gov.

How Obsidian Ridge helps

Ridge Watch monitors individuals' and families' computers around the clock. Analysts in a 24/7 security operations center review every alert and act on it — remediate it, note it, or take the computer offline to contain it. Taking a computer offline is one of those three outcomes, not what happens every time. A contained computer stays offline until we review it, within one business day.

Ridge Watch works on Windows and Mac computers. On Windows Pro computers, Ridge Watch can also block remote-control programs nobody approved. Windows Home is not supported.

What Ridge Watch does not stop: a phone call, someone being talked into paying by gift card, wire transfer, or crypto, or, without blocking, a remote-access tool the person let in on purpose. CISA says those tools generally do not trigger antivirus software, so they may not raise an alert. Phones and tablets are not covered.

See plans and prices at Ridge Watch.