Call #18 · 2026-10-18

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning on your screen cannot tell you to phone anyone, and no real company needs to look at your computer to fix it.

“The caller offered the agent tea and cake, and the red warning on the screen was judged against the sitting room.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearRemote access requestFake scan or planted problems

nothing gained, script exhausted, tea undrunk · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing support, good afternoon. You've reached us about the warning on your screen, haven't you?
              
                  Fake pop-up with phone numberFake authority or brand impersonation
                
It assumes the reason for the call, so the person feels the warning is already confirmed and stops questioning it.
Real company: A real company never puts a phone number in a pop-up and never treats a screen warning as proof of a problem.

                Bernard
                Oh — well — now. Safenet Billing, you said? Because the screen's saying something about a SafeHarbour, and I did wonder if it was the harbour people, we've got a little one down at the front. Anyway, yes, there's a great red thing on the laptop and it won't budge.
              
                Caller
                SafeNet, yes, sorry, the screen just truncates it — that's us. Now, that red warning means the machine is already compromised this very minute, so we do need to move quickly.
              
                  Urgency or fearFake authority or brand impersonation
                
A ticking clock shuts down careful thinking, so people act on the warning before they check whether it is real.
Real company: A real security firm never cold-calls about a warning on your screen, and never rushes you into acting within minutes.

                Bernard
                Compromised, is it. Hmm. You know, the budgie next door has learned the telephone — I'm not joking, it does a little ring-ring and then a voice. Anyway. Quickly, you said. Quickly for what, exactly?
              
                Caller
                Quickly because our own monitoring flagged it — I'm authorised to act on this. Now, before anything else, I need to confirm I'm speaking to the registered householder, so can you confirm the name on the account for me?
              
                  Fake authority or brand impersonationUrgency or fear
                
Claiming official authority and time pressure makes people answer questions before they stop to check who is really calling.
Real company: A real company already has your account details and would not cold-call to ask you to confirm your own name.

                Bernard
                The name on the account. Oh — well — now I'd have to think, because my cousin Peter used to sell insurance and he'd say never say a name down the phone, and he's been right about most things. Peter it was. Or — no, Percy. Percy. Anyway, are you warm enough there?
              
                Caller
                Percy, right, lovely, I'll put that down. Now — the warning on your screen, I really do need to see what it's flagging, so if you'd just let me have a look at your computer for a moment, I can clear this whole thing off it.
              
                  Remote access requestFake scan or planted problems
                
Offering to look at the computer feels like help, and the warning on screen makes the offer seem necessary.
Real company: A real security company never asks to connect to your computer from an unexpected call, and would tell you to contact them through official channels.

                Bernard
                Have a look at it. Well. The kettle's just gone, you see, so I'd have to sort that first. Would you like a cup of tea while you wait? I've got a nice bit of cake too, if you're eating properly.
              
                Caller
                That's kind, honestly. Look — I'll be quick, I just need the screen shared so I can glance at the warning, that's all it is. Is the machine switched on in front of you?
              
                  Remote access requestFake scan or planted problems
                
Asking to share the screen feels small and helpful, so the target agrees before thinking about what it exposes.
Real company: A real support team never asks to view your screen from a cold call. You call them, on a number you looked up yourself.

                Bernard
                Is it switched on. Oh, that's a question. It's the little grey one, and there's a bright red thing on it with a number and a lot of nines in it. D'you know, that red would clash terribly with the sitting room. Does it come in green?

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →