Bernard Doesn't Press That The Fraud Desk
Line quiet

Call #348 · 2026-10-21

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

15
Minutes wasted
6
Red flags found
11
Lines spoken
0
Scammer success
Call report

The Pop-Up with a Phone Number

No real support engineer needs you to open the machine or let them in after a warning appears on your screen.

“The caller asked to be let inside the machine, and Bernard asked whether the way in was the battery flap.”

Fake pop-up with phone numberFake authority or brand impersonationFake scan or planted problemsUrgency or fearRemote access requestUnsolicited contact

access sought, access refused, caller hung up · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

Caller Right, you rang the number on the screen, so you're through to SafeNet Billing and that warning is genuine — it's flagged your machine this morning. Can you read me the reference at the top of it?
Fake pop-up with phone numberFake authority or brand impersonationFake scan or planted problems

It treats the pop-up as proof and the phone number as a real support line, so the warning feels confirmed by a person.

Real company: A real security company never puts a phone number in a pop-up, and never treats a screen warning as proof of a problem.

Bernard Oh — well, now, SafeNet, you said. My nephew's with a firm sounds a bit like that. The reference at the top, you said? I've got my glasses somewhere. It's rather a lot of red, isn't it. Is that meant to be red?
Caller Red's exactly how it's meant to look, so don't go hunting for those — the warning's on a clock, and if it isn't dealt with soon the machine locks itself. What does it say near the phone number on it?
Urgency or fearFake pop-up with phone number

A countdown makes people act before they think, and asking about the number keeps them reading the fake warning.

Real company: A real security warning never runs on a clock and never asks you to call a number printed on it.

Bernard Well, there's a number with rather too many nines in it, and a little picture of a padlock. Locks itself, you say. That doesn't sound very friendly. Would it lock the radio too, or just the machine?
Caller Worry about the machine, not the radio — SafeNet Billing's own engineers flagged this one, so it's us you're dealing with now. The number with the nines is our priority line, so you've done the right thing ringing it.
Fake authority or brand impersonationFake pop-up with phone number
Bernard Oh, that's a relief. So you're the engineers. Tell me, do you lot wear a uniform, or is it more shirt and tie? Only I've the back step wants painting before winter and I can't decide on a colour.
Caller Never mind the step for now — what I actually need is to be let into the machine so I can clear this off it. If you just let me have a look at your screen, I can see the warning for myself.
Remote access requestFake scan or planted problems

Asking to see the screen feels like a small, helpful step, so the victim lowers their guard before real control is handed over.

Real company: A real support team never asks to view or control your screen from an unexpected call. You call them, not the reverse.

Bernard Let you have a look at it — oh. Well, I'd have to get it out of the case. It lives in the case, you see, since the visit. Hang on, that's the front door. No, it's next door's. What was it you wanted again?
Caller Letting me into the machine — that's the whole reason I called. So if you could just bring it out of the case and give me a way in, I'll have this cleared in no time.
Remote access requestUnsolicited contactUrgency or fear

Asking to be let into the device sounds like the fix, so the victim hands over control without realising that is the theft.

Real company: A real support team never asks to enter your device from an unexpected call. You call them, through a number you look up yourself.

Bernard Give you a way in. Into the machine. Well, it's got a little flap at the back, but I think that's the battery. Would that be the way in, do you think, or is there a proper door on it?
Caller Forget it. I'm putting the phone down now.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →