Call #1203 · 2026-10-31

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A pop-up warning is not a diagnosis, and a company that phones you about it is not a company.

“The agent asked to look at the machine, and the householder offered sugar and described a grey box that does not like being moved.”

Fake pop-up with phone numberUrgency or fearFake authority or brand impersonationFake scan or planted problemsRemote access request

warning unaddressed, access refused, caller rang off · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing here, and I'm glad you picked up, because the warning on your screen is still showing and that's a serious one.
              
                  Fake pop-up with phone numberUrgency or fearFake authority or brand impersonation
                
The caller treats the scary pop-up as confirmed fact, so the warning feels real and the call feels like help arriving.
Real company: A real security company never phones the number in a pop-up, and never treats a screen warning as proof of a problem.

                Bernard
                Oh — well — now, is that the one with the yellow triangle? Only a thing popped up over my crossword and I've half a mind it's the weather page being cross with me. Was it SafeBelt you said?
              
                Caller
                SafeNet Billing, yes, and that yellow triangle is the warning, so please don't dismiss it. It's spreading through the machine as we speak, and we need to sort it before it goes any further.
              
                  Urgency or fearFake scan or planted problemsFake authority or brand impersonation
                
A scary warning plus a ticking clock pushes people to act fast and skip checking whether the warning is real.
Real company: A real security firm never phones about a pop-up and never tells you to keep it open. They wait for you to contact them.

                Bernard
                Spreading, is it? Like that ivy along the back fence — took me all of Saturday and half of Sunday, and the neighbour's cat sat and watched the whole performance, no help at all. Is it urgent, then?
              
                Caller
                Urgent is exactly the word, and there's no time to spare on it. SafeNet Billing has this logged as an active infection, so every minute that warning stays up the worse it gets.
              
                  Fake authority or brand impersonationUrgency or fear
                
                Bernard
                Active inspec— right. Oh, hang on, sorry — I've left the back door on the latch, the wind gets under it something dreadful. Back in two ticks. Now, where were we? You said SafeBelt had it written down somewhere?
              
                Caller
                I'm with SafeNet Billing and yes, it's written down right here in front of me. What we do next is simple — if you'd just let me have a look at the machine, I can take the problem off your screen myself.
              
                  Remote access requestFake authority or brand impersonation
                
Offering to take the problem away sounds helpful, so the victim relaxes and hands over control of their own computer.
Real company: A real company never asks to take over your computer from an unexpected call. It tells you to hang up and contact them through their official number.

                Bernard
                Have a look at it yourself — oh, that's good of you. It's the little grey one that lives on the sideboard, doesn't much like being moved. What colour would you be wanting it in?
              
                Caller
                Grey's the one, the little grey one, yes. If you could just let me into it, a few small things on your end and I can see exactly what the warning's done.
              
                  Remote access requestFake pop-up with phone number
                
                Bernard
                Oh, that's the one sitting on the sideboard doing nothing. Do you take sugar in yours?
              
                Caller
                I'll ring you back another day. Bye now.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →