Bernard Doesn't Press That The Fraud Desk
Line quiet

Call #513 · 2026-10-23

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

15
Minutes wasted
5
Red flags found
11
Lines spoken
0
Scammer success
Call report

The Pop-Up with a Phone Number

A warning that arrives on your screen and hands you a number to call is not a warning, it is an advert for the caller.

“Nothing was installed, nothing was paid, and the call went nowhere.”

Fake pop-up with phone numberUrgency or fearFake authority or brand impersonationFake scan or planted problemsRemote access request

access refused, warning unresolved, caller hung up first · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

Caller SafeNet Billing, you're through to the team that handles the alert on your screen. That warning's a serious one, so let's not sit on it.
Fake pop-up with phone numberUrgency or fearFake authority or brand impersonation

The caller treats the scary pop-up as real and already known, so the target believes the warning and trusts the person who rang about it.

Real company: A real security firm never phones the number in a pop-up. You would look up their number yourself and call them.

Bernard Oh — right — the screen's gone a funny colour, is that what you mean? SafeBelt, did you say? I've got the fire to see to in a minute, but tell me again what the trouble is.
Caller SafeNet Billing. The colour on that screen means the infection's already spreading, so every minute counts here. Before you do anything with the fire, we need to sort the warning.
Urgency or fearFake scan or planted problems

A ticking clock and a spreading threat push people to act before they think or check anything.

Real company: A real security firm never cold-calls about a warning on your screen, and never rushes you.

Bernard Spreading, you say? Hmm. Well, I've got a jar of marmalade I made myself, and it's not set properly, so I'm rather in two minds about spreading. That's not the same thing, is it. What's this warning got to do with SafeBelt?
Caller It's SafeNet, and the warning's got everything to do with us — that alert came from our system. I'm the one who can clear it, but I need us to stay on it.
Fake authority or brand impersonationUrgency or fear
Bernard SafeNet, right, I'll try and remember that. Now the colour on the screen, is it meant to be blue? Only I had a programme on last night, and I'm not sure if it was that or the weather.
Caller Blue or not, it's the notice on it I care about, and that's ours. Look, the simplest way past this is for me to have a look at the machine myself — just let me have access to it.
Remote access requestFake pop-up with phone numberFake authority or brand impersonation

Offering to fix the problem personally feels helpful, and the pop-up already made the problem seem real.

Real company: A real software company never asks to connect to your computer from a cold call, and points you to its official support page instead.

Bernard Have a look at it? Well, you're very welcome to call round, I've got nothing on. The front path is a bit slippy, mind. Would you want a cup of something when you get here?
Caller I can't come round — I work off a desk, and the machine's up there with you. That's why I need access to it from here, so I can see the notice for myself.
Remote access requestFake authority or brand impersonation
Bernard Oh, from the desk. So you can see it from there but I can't see you. Well, I suppose that's how it works these days. I'm still working out what half the noises in this house mean, and most of them turn out to be the pipes.
Caller I'll send it in the post instead. Save us both the trouble. Goodbye.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →