Bernard Doesn't Press That The Fraud Desk
Line quiet

Call #343 · 2026-10-21

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

15
Minutes wasted
5
Red flags found
11
Lines spoken
0
Scammer success
Call report

The Pop-Up with a Phone Number

A warning on your screen that comes with a phone number is there to make you call it, so call your own bank instead.

“The caller wanted a look at the machine in the front room, and Bernard was in the hall with a stuck lid, which he treated as the more pressing matter.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearRemote access requestFake scan or planted problems

warning ignored, caller gave up the line · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

Caller SafeNet Billing, you're through to the screen warning team — is that the message on your laptop that's brought you to us?
Fake pop-up with phone numberFake authority or brand impersonation

It treats the number on the screen as a real support line, so the victim believes they called the right place.

Real company: A real security firm never puts a phone number in a warning and never answers as if you called them.

Bernard Oh, hello — yes, there's a great red thing all over the screen, very red. SafeBelt Billing, did you say? Are you warm enough where you are?
Caller SafeNet Billing, yes — and never mind me, it's that warning that matters. It's showing as active right now, and it won't sit there quietly forever.
Urgency or fearFake pop-up with phone number

It pushes the listener to act on the warning before thinking, and treats the pop-up as a live threat.

Real company: A real company never treats a pop-up as a live threat or rushes you to act on it.

Bernard SafeBelt, right, I'll remember that. Now — forever, you say. Well, it's been up there since Tuesday and it hasn't budged, so I don't know about forever.
Caller SafeNet Billing, and I should say we're the billing protection division, so this is properly logged with us. Now — that warning is the machine telling you it's compromised, and I need to get you off it.
Fake authority or brand impersonationUrgency or fear
Bernard Billing protection. Well, my cousin Cyril sold insurance once, so I know all about protection. He was dreadful at it, mind. What is it you'd be wanting me to do?
Caller Right — what I want is for you to let me have a look at that machine, just a quick look so I can clear the warning off it for you.
Remote access requestFake scan or planted problems

Offering to fix a problem he invented makes the stranger seem helpful rather than dangerous.

Real company: A real software company never phones you about a warning and never asks to look inside your computer.

Bernard Oh, now, there's a thing. The machine's in the front room and I'm in the hall with the phone, and there's a tin of biscuits here I can't get the lid off. Hold on a moment, would you?
Caller No, no, don't go wandering off — the warning is on the screen in the front room, that's the bit I need. Can you get back to it and just let me have a look?
Remote access requestFake pop-up with phone number
Bernard Back to the front room, right you are. Only the lid's gone and got itself stuck, and I've had a devil of a job. What was it you wanted to look at again?
Caller I'll try again when the line's behaving. Good afternoon.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →