Bernard Doesn't Press That The Fraud Desk
Line quiet

Call #1283 · 2026-10-31

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

15
Minutes wasted
6
Red flags found
11
Lines spoken
0
Scammer success
Call report

The Pop-Up with a Phone Number

A warning that arrives on your screen and comes with a number to ring is bait, and the thing behind it wants into your machine.

“The caller kept asking to be let into the machine, and the householder kept working out whether that meant the front door.”

Fake pop-up with phone numberFake authority or brand impersonationUnsolicited contactUrgency or fearFake scan or planted problemsRemote access request

door stayed latched, caller posted nothing, no harm done · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

Caller SafeNet Billing, support line, good afternoon. I'm told there's a warning showing on your screen — that's the one we need to deal with, so I'll walk you through it.
Fake pop-up with phone numberFake authority or brand impersonationUnsolicited contact

A calm, official-sounding voice turns a scary pop-up into a shared problem, so the target trusts the caller instead of the screen.

Real company: A real company never calls about a pop-up. You would look up their number yourself and call them.

Bernard Oh — hello there. Safebelt, did you say? Now then, before we get going, are you warm enough where you are? Only it's turned bitter here, and I've got the little radiator on in the hall.
Caller SafeNet Billing, yes. The warning on your screen won't wait, though — the longer it sits there the worse the trouble gets, so let's deal with it now while I've got you.
Urgency or fearFake pop-up with phone numberFake authority or brand impersonation

A ticking clock shuts down thinking, so the target acts fast to escape a threat they never actually faced.

Real company: A real company never rushes you off a warning on your own screen. It gives you time and a way to verify through official channels.

Bernard SafeNet, right, I'll remember that. Well the screen's been sitting there lit up like a Christmas tree and I haven't touched it — I don't like to interfere. My cousin Derek sold insurance, you know, and he said never touch anything in a hurry.
Caller I'm the support team for that warning, so nothing gets touched until I say. Now, that message on your screen came from us — your machine is flagging as infected.
Fake authority or brand impersonationFake scan or planted problems

Claiming to be the source of the warning makes the alert feel official and makes Bernard wait for permission before acting.

Real company: A real security team never claims ownership of a pop-up and never asks you to hold off while they direct you.

Bernard Infected, is it? Oh dear. Would that be catching at all? Only I've something on the go in the kitchen and I'd hate for it to spoil while I'm sat here.
Caller It stays on the machine, it won't get near anything in the kitchen. Let's get me looking at it — if you just let me have access to your screen, I can see exactly what's going on.
Remote access requestUnsolicited contact

Offering to look at the screen feels like hands-on help, so the victim lowers their guard and hands over control.

Real company: A real support team never asks to take over your screen from a cold call. You call them, not the other way round.

Bernard See my screen? Oh — well — now. There's my reading glasses somewhere, I can't see the screen anyway without those. Hang on, let me just — no, that's the television guide.
Caller Glasses or not, I can see what you can't. Just let me in to the machine and I'll take it from there — that's how we get to the bottom of it.
Remote access requestFake scan or planted problemsUrgency or fear
Bernard Let you in? There's no one in, it's just me and the parrot. Do you mean the front door, because that's on the latch and I'd have to put the phone down to reach it.
Caller I'll send it in the post instead. Save us both the trouble. Goodbye.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous