Call #28 · 2026-10-18

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

No real company sees a warning on your screen and needs to connect into your machine to fix it.

“The caller asked to connect into the machine. Bernard asked whether the screen would fit down the line.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearRemote access request

script exhausted, no access, kettle boiled · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing, support desk, how can I help? … Ah, that's not a budgie, sir, that's just interference on the line — now, about the warning on your screen, I'll be quick.
              
                  Fake pop-up with phone numberFake authority or brand impersonationUrgency or fear
                
A named support desk and a quick dismissal of the odd noise make the call feel routine and official.
Real company: A real security company does not call you about a pop-up, and never asks you to ring a number shown on your screen.

                Bernard
                Oh — well — now, you say "Save Net," but the box on my screen says "Safe Net," is that the same firm? Only my cousin Dennis sold insurance and he always said a wrong name on a letter means it's not worth the paper.
              
                Caller
                SafeNet Billing, that's right, sir, one word, and your cousin sounds like a cautious man. The thing is, that warning on your screen is time-sensitive — if it isn't dealt with today, the machine locks itself down entirely.
              
                  Urgency or fearFake pop-up with phone number
                
A deadline makes people act before they think, so they skip checking whether the warning is real.
Real company: A real security firm never puts a countdown on a pop-up and never asks you to call a number on your screen.

                Bernard
                Does it indeed. Well, Dennis was cautious, but he also drove a mustard-coloured car, so I don't take everything he said. Locks down entirely — would that be before or after the kettle? I've got it on and it's just coming up to the boil.
              
                Caller
                Before the kettle, sir, this is rather more urgent than tea. I'm from the authorised billing division, you see, so I can see the alert on your account from my end.
              
                  Fake authority or brand impersonationUrgency or fear
                
A made-up official title plus a claim to see the problem on their side makes the caller sound like an insider with real power.
Real company: A real company names itself plainly and lets you call back on a number you find yourself.

                Bernard
                The authorised what, sorry? My left ear's not the best. And did you say you can see my account — I can't even see my account, our Kenneth does all that. Would you like a cup while we sort it? I've got a saucer out and everything.
              
                Caller
                The authorised billing division, sir — SafeNet Billing. No cup, thank you, I'm not in the building. Look, the quickest way is if you just let me have a look at the machine myself — it'll only take a moment.
              
                  Remote access requestFake authority or brand impersonation
                
Offering to look at the machine himself sounds helpful and quick, so the victim hands over control without thinking.
Real company: A real billing department never asks to take over your computer. It sends a written bill and you pay through your own account.

                Bernard
                Let me have a look at it — is that on the telephone, like? Because I don't think the screen would fit down the line. Hold on — Mavis, don't chew that. Sorry, the parrot. She's taken against the cable.
              
                Caller
                No, not down the line, sir — I'd need to connect into it from here, very briefly. There's nothing to it, honestly, I'll be quick.
              
                  Remote access requestUrgency or fear
                
Asking to connect in 'very briefly' makes a big intrusion sound small and routine, so the target waves it through.
Real company: A real support team never connects into your device from an unsolicited call, and will point you to official support channels instead.

                Bernard
                Connect in — would that be like the electricity? Because the man from the electric came in March and said the wiring was a miracle. Oh — the budgie next door's doing the ringing again, that's the phone going. What was it you wanted connecting?

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →