Call #1543 · 2026-11-03

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning that appears on your screen and gives you a number to call is not a warning, it is an advert for the next caller.

“The caller wanted to be let onto the machine and Bernard wanted to know who was paying for the visit.”

Fake pop-up with phone numberUrgency or fearFake authority or brand impersonationRemote access request

offer to visit refused, caller clocked off · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing here, you're through to the billing security line. Now then, about the warning on your screen — that's a serious one, and I need you to stay with me.
              
                  Fake pop-up with phone numberUrgency or fearFake authority or brand impersonation
                
The caller treats a scary on-screen warning as real and already known, so the target believes the problem is confirmed and trusts the person who rang.
Real company: A real company never phones you about a pop-up. You would look up their number yourself and call them.

                Bernard
                Oh — SafeBelt Billing, is it? Well, that's a new one on me. There's a great red thing across the whole laptop and it's blinking at me, and I'll be honest, I thought it was part of the programme. Is it meant to be red?
              
                Caller
                Red means it's already flagged your machine, that's the worst colour it does. SafeNet Billing, by the way — every minute it sits there the worse it gets.
              
                  Urgency or fearFake authority or brand impersonation
                
                Bernard
                Worse, is it? Well, give me a second, the fire's gone down and it wants another shovel before it sulks. You don't mind, do you? Won't be a tick.
              
                Caller
                I'll wait, but the clock's against us — and that fire can wait, this is your machine we're talking about. SafeNet Billing doesn't flag something like this lightly, so it really does need dealing with now.
              
                  Fake authority or brand impersonationUrgency or fear
                
                Bernard
                Right, that's better, it's drawing lovely now. Now what was it — SafeBelt, you said? Sounds like something you'd wear. Is this a proper job, then, or do you do it from home in your slippers like the rest of us?
              
                Caller
                SafeNet Billing, and it's a proper outfit — but never mind that. Look, I can't see what the warning's done from here, so the way this works is I take a look at the machine myself.
              
                  Remote access requestFake authority or brand impersonation
                
Offering to look at the machine sounds like helpful service, so the victim hands over control without realising what it means.
Real company: A real software or billing company never takes control of your computer from a cold call. It points you to its official support page.

                Bernard
                Take a look, can you? Well, that's very good of you. Only the laptop's in the back room and I've got a programme just starting on the wireless. What would you be looking for, exactly — is it a big thing?
              
                Caller
                Quick as anything, I promise — you just let me onto the machine and the warning's gone before you know it.
              
                  Remote access requestUrgency or fear
                
                Bernard
                Let you on. Hm. Well — is that what your lot usually do, do they come in the post or what? I'd want to know who's footing the bill for the visit.
              
                Caller
                Honestly, I don't know why I bother. Good afternoon.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →