Bernard Doesn't Press That The Fraud Desk
Line quiet

Call #203 · 2026-10-20

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

15
Minutes wasted
5
Red flags found
10
Lines spoken
0
Scammer success
Call report

The Pop-Up with a Phone Number

A red warning that arrives with a phone number to call is an advert, not an emergency, so nobody legitimate needs to look inside your computer.

“The infection was spreading fast and the only thing that moved was a slipper under the chair.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearFake scan or planted problemsRemote access request

script exhausted, no access, slipper missing · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

Caller SafeNet Billing support, good afternoon — you're through to the team about the warning on your screen, is that right?
Fake pop-up with phone numberFake authority or brand impersonation

It treats the pop-up as already proven, so the person focuses on fixing the problem instead of questioning whether it was real.

Real company: A real company never puts a phone number in a warning pop-up and waits for you to call it.

Bernard Oh — well, hello. Safe... Saffron Billing, did you say? There's a lovely yellow to that, isn't there. Yes, the screen's gone all red and shouty at me. Mavis doesn't care for it.
Caller SafeNet, yes — Billing. Bernard, that red warning means the infection's already spreading through your machine, so I do need you to stay with me on this, right now, before it goes any further.
Urgency or fearFake authority or brand impersonationFake scan or planted problems

It turns a scary pop-up into a live emergency, so the person acts fast instead of thinking or checking.

Real company: A real security firm never cold-calls about a warning on your screen and never rushes you to act on the spot.

Bernard Spreading, you say. Ooh, that's like the damp in the back bedroom, took me months to get on top of that. Would you like a cup of tea while we sort it? The kettle's only just gone on.
Caller I can't stop for tea, Bernard, I'm afraid — the infection spreads fast and I'm the technical lead handling your case personally, so this is coming from the highest level of SafeNet. Now, are you sitting in front of the screen?
Fake authority or brand impersonationUrgency or fear

Claiming to be the top technical lead makes Bernard feel singled out and important, so he stops questioning and follows along.

Real company: A real security team gives you a reference number and a public number to call back, and never rushes you.

Bernard The highest level — well, that's very good of you. Hang on, though, I've lost a slipper. One of them's gone right under the chair and I can't reach it with my foot. Do you ever have that?
Caller Yes — I mean, no, I can't reach under there myself, Bernard, I'm on the phone. Look, while you're down there, this is the moment to let me have a look at your computer properly, so if you just let me into it we can stop this thing together.
Remote access requestUrgency or fear

Framing access as teamwork makes the victim feel like a partner in fixing a crisis, so handing over control feels helpful rather than risky.

Real company: A real support team never asks to connect into your computer from an unexpected call. You call them, on a number you look up yourself.

Bernard Down there — you make it sound like I'm on the floor, and I'm not, I'm in the good chair. Let you into it, you say. Into the computer? It's got a lid that folds, would that help?
Caller There's no lid to worry about — I mean, yes, and you just let me see it, that's all, and I'll deal with the rest. Honestly, Bernard, could you just — sorry. It's been a long shift. Just let me look at the machine, please.
Remote access requestUrgency or fear

The caller pushes past Bernard's question and asks to see the machine, so access to the device becomes the next small step.

Real company: A real support team explains the problem in plain terms and never needs to look inside your computer to do it.

Bernard Long shift — you want to sit down, love. Have you eaten? My neighbour brings me a bit of stew on a Tuesday and there's a portion left. Now, look at the machine. Which bit of it, the screen or the back where the wires are?

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →