Call #258 · 2026-10-20

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning on your screen is not proof of a fault, and a number on it is not proof of who is calling.

“The caller offered to look at the machine from their end. Bernard asked whether it would be more like the telephone line or two tin cans.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearRemote access requestFake scan or planted problems

connection never made, warning unproven, caller put the phone down · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing, you're through to the team that handles the warning on your screen. You did the right thing ringing the number it gave you.
              
                  Fake pop-up with phone numberFake authority or brand impersonation
                
It praises the person for calling, which makes them feel smart and lowers their guard before any request is made.
Real company: A real company never puts a support number in a warning pop-up and never treats a cold call as proof of a problem.

                Bernard
                Oh — well — now, that's a relief. Though I've got it written down here as Salford Billing, so you'll have to excuse me if I say it wrong the whole way through. Did you say the warning was on the screen? I thought it was a screensaver, honestly.
              
                Caller
                Salford, SafeNet, same desk, don't worry about it. That warning isn't a screensaver though — it means something's already moving on that machine, and the longer it sits there the worse it gets.
              
                  Urgency or fearFake pop-up with phone number
                
It turns a harmless screen into a ticking threat, so the person acts fast instead of checking.
Real company: A real security team explains the issue in writing and never rushes you into a call.

                Bernard
                Something moving, you say. Would that be like woodworm? My cousin Dennis sold insurance and he was always going on about things moving about where you can't see them. Will it need feeding, do you think?
              
                Caller
                Feeding — no, sir, it's not an animal. It's a warning from our monitoring systems, which means we're already aware your machine is compromised. That's why I need you to let me check it before it spreads.
              
                  Fake authority or brand impersonationUrgency or fearRemote access request
                
Claiming an official monitoring system makes the caller sound like an authority who already knows the truth, so doubt feels pointless.
Real company: A real security team never phones out of the blue to inspect your machine. They publish alerts and let you contact them.

                Bernard
                Aware, are you? That's clever. Now the thing is, the machine sits in the front room and my cousin Dennis always said don't let anyone look at your business till you've had a cup of tea. Are you warm enough where you are?
              
                Caller
                Tea's a fine idea, but I'd hold off till we've sorted this. All I need is for you to let me have a look at it from my end — a quick connection, and I'll take the whole thing off for you.
              
                  Remote access requestUrgency or fear
                
                Bernard
                A quick connection. Oh — well — hold on, was that a knock at the door? No. False alarm. You were saying about a connection — would that be like the telephone line, or more like a wire between two tin cans?
              
                Caller
                Nothing so old-fashioned as cans. It runs down the line, and once I'm on it the warning comes off your screen for good. Your name's on the account with us already, so there's nothing to worry about there.
              
                  Remote access requestFake scan or planted problems
                
It offers a simple fix for a scary warning and pairs it with reassurance that they already know who you are.
Real company: A real software company never asks to connect to your device from an unexpected call, and would point you to support you contact yourself.

                Bernard
                On the account, am I? That's nice. I can't remember putting my name to anything, mind. Was it my late wife who arranged it? She did all that sort of thing.
              
                Caller
                I'll ring you back another day. Bye now.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →