Call #13 · 2026-10-18

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning on your screen is never a phone number to call, and a real support line will not rush you to read it out.

“He asked for every digit and got a biscuit tin instead.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearRemote access requestFake scan or planted problems

script exhausted, nothing read, no access · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing support, good afternoon. You're through about the warning on your screen, is that right? I'll be quick — I just need you to confirm what it says there for me.
              
                  Fake pop-up with phone numberFake authority or brand impersonation
                
Naming a problem the person can see on their own screen makes the call feel like a real response to a real event.
Real company: A real company does not phone you about a warning on your screen, and never asks you to read it out to them.

                Bernard
                Oh — well — now. SafeBelt Billing, is it? It's a big red thing, and it's got a number on it, and it keeps sort of flashing. Mavis doesn't care for it at all. She's my parrot. Would you like a cup of tea while we're at it?
              
                Caller
                SafeNet Billing, yes. And that flashing red thing, sir, it means the infection's spreading while we speak — every minute counts here, so I really do need you to focus on the warning.
              
                  Urgency or fearFake pop-up with phone numberFake authority or brand impersonation
                
A ticking clock makes people act fast and skip the step of checking whether the warning is real.
Real company: A real security firm never phones about a pop-up and never claims a countdown is running.

                Bernard
                Spreading, you say. Oh dear. Only my left slipper's gone under the chair and I can't reach it without kneeling, which I'm not meant to do. Wait — is it like weeds? My runner beans spread something rotten last summer.
              
                Caller
                Not like weeds, sir — like an emergency, and we're the certified engineers authorised to deal with it. That number on the screen, that's the only genuine line for this, so I'll need you to confirm you're looking at it and read out what it says.
              
                  Fake authority or brand impersonationFake pop-up with phone numberUrgency or fear
                
Claiming to be the only authorised fix makes the person stop checking and trust the number already on screen.
Real company: A real security team never declares itself the only genuine line, and never asks you to read a number off a pop-up.

                Bernard
                Certified, are you? That's nice. Well, I've got my reading glasses somewhere — I had them a minute ago. It says something about a, oh, a sort of warning, and then a lot of small print I'd not manage without the specs.
              
                Caller
                No need for the small print, sir, just put the glasses on and read me the number at the top — that's how I verify the warning's genuine. I'll be quick, then we can get you sorted.
              
                  Remote access requestFake scan or planted problemsUrgency or fear
                
It reframes a security step as a favour to the caller, so the person feels helpful rather than suspicious.
Real company: A real support team never needs a code read aloud to prove a warning is genuine, and would point you to the official app or number.

                Bernard
                Hold on a tick. There. Right, the big number at the top. It's got an awful lot of nines in it, I can tell you that much. Does that help? I don't want to read the whole thing out, I'd be here till Christmas.
              
                Caller
                Lots of nines, right, that's the one — but I need the whole thing, sir, every digit, or the system won't accept it. Honestly, I'm on my last nerve here.
              
                  Remote access requestUrgency or fear
                
Pushing for every digit at once and sounding frazzled makes Bernard feel he is helping a stressed person rather than handing over a key.
Real company: A real support agent never needs your full licence key read aloud, and would let you type it yourself on a page you opened.

                Bernard
                Oh, you poor thing. Are you eating properly? You sound like a man who's skipped his lunch. I'll tell you what, I've got a ginger biscuit tin in the kitchen and I can't be doing with all these numbers on an empty stomach.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →