Call #1358 · 2026-11-01

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning that appears on your screen is not proof of anything, and no real support desk needs to be let in remotely to fix it.

“The caller wanted the machine opened from where he sat, and the householder said he was not one for letting things in through doors he could not see.”

Fake pop-up with phone numberFake authority or brand impersonationFake scan or planted problemsUrgency or fearRemote access requestUnsolicited contact

no number read, no entry given, the caller rang off first · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                That's right, you're through to SafeNet Billing support, and I'm looking at the alert that's up on your screen right now. It says the machine's infected — can you read the reference number off it for me?
              
                  Fake pop-up with phone numberFake authority or brand impersonationFake scan or planted problems
                
The caller claims to see the same alert on your screen, which makes the warning feel real and personal.
Real company: A real security company never calls about a pop-up and never asks you to read a reference number off your own screen.

                Bernard
                Oh — SafeBelt, is it? Sorry, my left ear's a bit shy of the telephone. Now, there's a great box on the screen with a number in it, but I'd have to fetch my specs from the coal scuttle, and the fire wants another shovel first.
              
                Caller
                There's no time for shovels, sir — that alert means the infection is spreading while we sit here. Just the number from the box, before it gets any further.
              
                  Urgency or fearFake pop-up with phone number
                
A ticking clock shuts down thinking, so the target hands over details to stop a threat that does not exist.
Real company: A real security team never rushes you off a pop-up. They tell you to close it and contact support through the official site.

                Bernard
                Spreading? Well, that's a worry. Though I don't see how it'd get past the fireguard, and I've just this minute put the last of the coal on. Do you take sugar? I've only the one cup out, mind.
              
                Caller
                No tea, thank you — I'm not calling about that, I'm calling because your machine's in trouble. I'm from the technical side here, the one that handles the warnings, so you can trust me on this. Can you read me the number in that box?
              
                  Fake authority or brand impersonationFake pop-up with phone number
                
                Bernard
                Belt and braces, that's the way isn't it. You're the technical one — the one on the screen. Now, the little box has a number, you say. Would it be the long one or the short one? There's two, and one of them's a serial for the wireless.
              
                Caller
                The long one, the long one — never mind the wireless. Look, the fastest way to settle this is if you'd let me have a look at the machine myself, just for a moment.
              
                  Remote access requestUrgency or fearUnsolicited contact
                
Offering to look at the machine himself sounds helpful and quick, so the victim hands over control without thinking.
Real company: A real support team never takes remote control of your computer from an unexpected call. You call them, not the reverse.

                Bernard
                Have a look? Well, you're welcome, but you'd want to mind the step. The machine's in the back room and that door sticks something dreadful — I've been meaning to sand it down since the spring.
              
                Caller
                Not in person, sir. Remotely. You'd let me in from where you're sitting, over the line. It's all quite straightforward once you've got the warning up in front of you.
              
                  Remote access requestFake pop-up with phone number
                
                Bernard
                Oh, over the line, is it. Well, I don't know about that — the machine's got a mind of its own, and I'm not one for letting things in through doors I can't see. Was there a colour it comes in?
              
                Caller
                I'll try again when the line's behaving. Good afternoon.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →