Call #138 · 2026-10-19

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning that appears on your screen cannot phone you, and no real company needs remote access to fix it.

“The caller asked twice for remote access and never got it, because Bernard was still admiring the red box.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearFake scan or planted problemsRemote access request

script exhausted, no access, kettle on · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing, good afternoon. You're through about the warning on your screen, is that right? I'll be quick, it's just a couple of details and we can get that cleared.
              
                  Fake pop-up with phone numberFake authority or brand impersonationUrgency or fear
                
The caller acts as the known remedy for a scary warning, so the target feels relief and cooperates quickly.
Real company: A real security firm does not phone people who saw a pop-up, and never asks for details to clear a warning.

                Bernard
                Oh — well — now, is that SafeBelt? Only my cousin Dennis used to sell insurance, and he always said never trust a company with a belt in the name. Anyway, yes, there's a warning. It came up just as I was making a cup of tea.
              
                Caller
                SafeNet, not SafeBelt, sir. Look, I'll be quick, that warning means the machine's already compromised, so I do need to get this sorted before it spreads to the rest of the house.
              
                  Urgency or fearFake scan or planted problemsFake authority or brand impersonation
                
A ticking clock and a threat to the whole household push people to act before they think to check.
Real company: A real security firm never cold-calls about a warning on your screen and never rushes you to act.

                Bernard
                Spreads, does it? To the rest of the house? Well, it's only the one computer — Mavis doesn't use it, she just shouts at it. Sorry, who am I speaking to? You've got a lovely clear voice, better than the man on the radio.
              
                Caller
                I'm... let me just check the queue, there's a lot of these today. The point is that warning's official, comes straight from our monitoring side, and I need to take you through it now.
              
                  Fake authority or brand impersonationUrgency or fear
                
Claiming the warning is official and comes from a monitoring team borrows trust the caller has not earned.
Real company: A real security team points you to their official app or website, not a phone number in a pop-up.

                Bernard
                Take me through it — right you are. I'll just put the kettle on while you do that, it's no trouble. Oh, and mind the budgie next door when you're talking, he's learned the phone and he does like to join in.
              
                Caller
                Forget the kettle, sir, this needs doing while the connection's still live, I'll be quick. Is the machine switched on in front of you? Because we'll need to get onto it, just a bit of remote access so I can look at the thing myself.
              
                  Remote access requestUrgency or fear
                
Asking to connect to the computer lets the caller control what Bernard sees and turn a vague worry into a visible problem.
Real company: A real support team never takes remote control from a cold call, and will point you to official contact details you look up yourself.

                Bernard
                Remote access — would that be like the telly remote? Because I've got two of those and neither of them works the telly. Hold on, I'm just having a look. It's switched on, yes, there's a sort of big red box on it with a number on.
              
                Caller
                Yes, the red box, that's the one. Right — I'll talk you into letting me on, it's only a few clicks, and then I can look at the thing myself and clear the whole lot off for you.
              
                  Remote access requestFake scan or planted problems
                
Offering to take control feels like hands-on help, so the victim relaxes and stops checking.
Real company: A real support team never asks to connect to your device from an unexpected call. You call them.

                Bernard
                Clear the whole lot off, you say. It's a lovely red, mind — very bright. Would it stay red, or does it go a different colour once you've done whatever you're doing? Only I'm rather partial to the red.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →