Call #378 · 2026-10-22

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A pop-up that tells you to ring a number is not a warning from anyone, it is an advertisement for the person who answers.

“The caller kept asking for the exact words on the screen and Bernard kept not being at the screen.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearFake scan or planted problemsRemote access request

warning unread, shop still needed, caller rang off · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing, you've reached the number on the warning, so you're through to the right place. Tell me what your screen's showing right now.
              
                  Fake pop-up with phone numberFake authority or brand impersonation
                
The caller confirms the number on the screen, so the victim believes they dialled the real company and stops doubting.
Real company: A real security firm never puts a phone number in a warning pop-up and never asks you to call it.

                Bernard
                Oh — well — now, the screen's gone all red and shouty. But hold on, was it Wholesafe Billing or Safehaven? Only I've got a lad does my gutters called Trevor and he says never trust a screen.
              
                Caller
                SafeNet Billing, sir, and there's no time to be weighing that up — that warning means the infection's spreading while we chat. Every minute counts now, so what does the screen say?
              
                  Urgency or fearFake authority or brand impersonation
                
A ticking clock shuts down careful thinking, so the target answers fast instead of checking the claim.
Real company: A real security firm gives you time to verify the alert through official channels before asking anything of you.

                Bernard
                Spreading, is it? Hm. There was a programme about lighthouses in — oh, eighty-seven, I think — and the fellow kept saying the tide doesn't wait. I liked that. Anyway, you'll want to know what's on the screen and I keep meaning to look properly.
              
                Caller
                You're listening to me, sir, that's the main thing — and I need you to see this as the tide, because SafeNet Billing's register is flagging your machine as compromised right now. Have a proper look and tell me the exact words.
              
                  Fake authority or brand impersonationFake scan or planted problems
                
A confident brand name and a claim of an official alert make the warning feel like a verified fact rather than a stranger's word.
Real company: A real billing company contacts you in writing through its own app or website, not by cold call asking you to read out screen text.

                Bernard
                The exact words — right you are. Hang on while I get my glasses on. Oh, the parrot's kicking off now, she does that whenever the phone rings. Do you have any pets at all?
              
                Caller
                No pets worth discussing when your machine's in this state, sir — SafeNet Billing's flagged it and I can't lift the warning from my end. Are you at the screen yet?
              
                  Remote access requestFake authority or brand impersonationUrgency or fear
                
It pairs a made-up warning with a friendly push to get him to the screen, so acting fast feels like the only way to fix it.
Real company: A real company never calls out of the blue about a warning on your computer and never needs you at the screen to lift it.

                Bernard
                I'm on my feet, don't you worry. Only the tin's empty and I've been meaning to go down the shop. You were saying about the— about that red business on the screen?
              
                Caller
                Yes, the red business, sir — that's the warning SafeNet Billing put there because your machine's compromised. Never mind the shop; read me what the red letters say.
              
                  Fake scan or planted problemsRemote access requestFake authority or brand impersonation
                
                Bernard
                Red letters. Well, I'd have to lean right in, and my left ear's no good for that sort of thing. What was the firm called again — Save-a-Bit, was it?
              
                Caller
                I'll try again when the line's behaving. Good afternoon.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →