Call #473 · 2026-10-23

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A countdown on your screen is a picture, not a clock, and no support line needs to be let inside your machine to fix it.

“The caller insisted the warning was live and the clock was running, then hung up when asked how a look inside the machine would work.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearFake scan or planted problemsRemote access request

warning stayed up, nobody came in, the line cleared itself · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing, you've reached the number on the warning screen. The big red panel on your laptop — you're looking at it right now, aren't you.
              
                  Fake pop-up with phone numberFake authority or brand impersonation
                
It assumes the victim is staring at a scary warning, so the call feels like a reply to something real.
Real company: A real security firm never puts a phone number on a warning screen and cold-calls people who see it.

                Bernard
                Oh — well — now, I don't know about red, it's more of an orangey colour on mine, or it might be the light in here. Have you eaten? Only I've got a bit of a flapjack situation on the go and it's gone a bit crumbly. What was the name of your firm again?
              
                Caller
                It's SafeNet Billing, and the colour doesn't matter, sir — what matters is the warning is live on your machine this very minute. Every second it sits there, whatever got in is digging deeper, so we really do need to move.
              
                  Urgency or fearFake authority or brand impersonation
                
A ticking clock stops the person from pausing to check anything, because delay itself feels dangerous.
Real company: A real security firm never phones from a pop-up and never pressures you to act within seconds.

                Bernard
                Safebet Billing, right you are. Now, is that a Tuesday? I only ask because I've had it down as a Thursday all morning, and then the woman on the wireless said something about it being the weekend, so I'm all at sea.
              
                Caller
                SafeNet Billing, and never mind the day. There's a warning sitting on your screen telling you the machine is compromised — I can see it flagged on our side, so let's not let it sit there until closing time.
              
                  Fake authority or brand impersonationUrgency or fearFake scan or planted problems
                
A named company plus a visible warning on your own screen feels like independent proof, so doubt fades fast.
Real company: A real security team never phones about a warning on your screen, and real alerts appear in the product, not in a cold call.

                Bernard
                Oh, it's still up, yes. It's got a little countdown on it, which I thought was a nice touch. Are you all warm enough where you are? It's turned bitter here.
              
                Caller
                A countdown is precisely my point, sir — that's the clock on the infection, and once it runs out the damage is done. Now, the fix is straightforward, but I can't reach the machine from here, so you'll need to let me have a look at it directly.
              
                  Urgency or fearRemote access request
                
A ticking clock makes people act before they think, so the request to reach into the machine feels like the only way out.
Real company: A real software company never asks to connect to your computer from an unexpected call, and it does not put a countdown on a fix.

                Bernard
                Ah, now you've lost me. Have a look at it how? It's in the front room and you're — well, you're wherever you are. Are you near a window?
              
                Caller
                Not physically, obviously — over the connection, the same way we run all our support. You let me onto the machine, I clear the warning off it, and you're done. Simple as that.
              
                  Remote access requestFake scan or planted problems
                
                Bernard
                Let me just pop my glasses on. Oh — now I've put them down somewhere. Do you ever do that? You'd think at my age I'd have a system.
              
                Caller
                Right. I'll let you get back to your afternoon. Goodbye.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →