Bernard Doesn't Press That The Fraud Desk
Line quiet

Call #298 · 2026-10-21

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

15
Minutes wasted
6
Red flags found
11
Lines spoken
0
Scammer success
Call report

The Pop-Up with a Phone Number

A warning that arrives with a phone number attached is an advert for the caller, not a fault on your machine.

“The caller said the alert proved it was genuine. Bernard said his glasses were on his head and asked after the weather.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearRemote access requestFake scan or planted problemsUnsolicited contact

no foothold given, no screen seen, the line went quiet · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

Caller SafeNet Billing, you're through to the screen team. That warning sitting on your display, that's our alert, and I can walk you through clearing it.
Fake pop-up with phone numberFake authority or brand impersonation

The caller claims the scary warning on screen is official, so the target trusts the number they dialled rather than questioning it.

Real company: A real security firm never puts a phone number in a pop-up and never calls you about a warning on your screen.

Bernard Oh, hello there. Well, that's a relief, I've been staring at it wondering what to do. I thought it was the television at first, you know, because it's Thursday and that's when— no, wait, it's Wednesday, isn't it. Anyway. Who did you say you were again?
Caller SafeNet Billing, the screen team. And that warning won't sit there quietly, it spreads if it's left, so the sooner we deal with it the better.
Urgency or fearFake authority or brand impersonation

A ticking clock stops people from pausing to check whether the warning is real.

Real company: A real security team tells you to close the window and contact support through the number on your own bill.

Bernard Spreads, does it? Like damp, that gets everywhere. Now then, you'll have to bear with me, I've mislaid my glasses and I can't read a thing on that screen. They were here a moment ago.
Caller Your glasses, right, but the words up there are large enough, aren't they? It's the SafeNet logo in the corner of that alert, that's how you know it's genuinely ours.
Fake authority or brand impersonationFake pop-up with phone number
Bernard Oh, they're on my head, the specs. Silly old thing. Sit down on a chair, anyway — no, you can't, can you, you're on the telephone. Are you warm enough where you are? It's turned quite cold for the time of year.
Caller Plenty warm here. Look, that warning on your display needs a proper look from our side, so if you let me have a quick route into your machine I can clear it off for you.
Remote access requestFake scan or planted problems

Offering to fix a problem you did not know you had makes the caller seem helpful rather than threatening.

Real company: A real software company never calls about a warning on your screen and never asks to connect into your computer.

Bernard Under the desk, you say? That's where the floor is, and my knees don't bend like they did. Is this going to take long, only I've got a programme starting.
Caller Not under the desk, no. Your computer screen, that's where I need to get a foothold, and it's the work of a moment if you'll just grant me the access.
Remote access requestUnsolicited contact

Asking to take control of the machine sounds like routine technical help, so the target lowers their guard and hands over the keys.

Real company: A real support team never takes remote control of your computer from a cold call. You call them, through a number you look up yourself.

Bernard Oh, you're the chap about the screen. I did wonder. Well, you've been very patient with an old fellow, I'll say that for you. You get yourself off now, it's a long way back to wherever you've come from.
Caller Right. I'll let you get back to your afternoon. Goodbye.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →