Call #1023 · 2026-10-29

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning that arrives with a phone number attached is an advertisement, not an emergency, and no legitimate technician needs to be let in remotely to look at your screen.

“The caller needed to be let in remotely, and Bernard asked whether it was the front door he meant, given the loose step.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearFake scan or planted problemsRemote access requestUnsolicited contact

lookalike line exhausted, screen unshared, nobody let in · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing, you're through to the support line — is that the warning on your screen you're ringing about?
              
                  Fake pop-up with phone numberFake authority or brand impersonation
                
The caller opens by naming a problem the person is already staring at, so the call feels like a reply rather than a cold approach.
Real company: A real company does not staff a phone line that answers a pop-up warning, and it never treats a screen message as proof of a fault.

                Bernard
                Oh — well — the screen's gone all blue and shouty, but I've got a photograph here I've been meaning to tell someone about. My nephew at the seaside, holding a crab. Is it supposed to be blue, this warning?
              
                Caller
                The blue means it's already active, sir — every minute you leave it, it burrows further in. That's why we need to deal with it right now.
              
                  Urgency or fearFake scan or planted problems
                
A ticking clock shuts down careful thinking, so the target acts before checking anything.
Real company: A real security team gives you written findings and time to verify them, never a countdown on the phone.

                Bernard
                Right you are, right you are. Only — hold on — there's a whistling coming from my ear. That's the hearing aid, it does that when I cup it. Anyway, this crab was no bigger than a saucer.
              
                Caller
                The hearing aid's fine, sir — it's the screen that needs us. I'm from SafeNet Billing, the official line for that warning, and nobody else can take it off for you.
              
                  Fake authority or brand impersonationUrgency or fear
                
                Bernard
                SafeNet — is that with one net or two? Only my neighbour's with something Net and I can never keep them straight. Oh, and you'll want something to drink, sitting there all day. Are you eating properly?
              
                Caller
                One net, sir, just the one — and I'm fine, thank you. For the warning to come off, I'll need to be looking at your screen with you, so I just need you to let me have a look.
              
                  Remote access requestFake scan or planted problems
                
Asking to view the screen feels like a normal support step, so the victim lowers their guard and hands over control.
Real company: A real support team never asks to take over your screen from a cold call, and would tell you to contact them through official channels.

                Bernard
                Oh, I couldn't have that — the screen's behind the pile of newspapers, and there's a photograph folded on top of it. My nephew again. He's got the same ears as his father, which is a shame.
              
                Caller
                That's all right, sir — leave everything where it is. I just need you to let me in remotely so I can look at that screen myself.
              
                  Remote access requestUnsolicited contact
                
Offering to take over the screen feels helpful and saves effort, so the target relaxes and hands over control.
Real company: A real support team never asks to control your device from an unexpected call. You call them on a number you look up yourself.

                Bernard
                In where, sorry? The front door's on the latch but the step's a bit loose. And I've got the wireless on in the other room — do you want me to turn it down?
              
                Caller
                I'll get someone else to ring you. Goodbye.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →