Call #53 · 2026-10-18

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning that appears on your screen with a phone number is bait. Real support does not call you about it.

“The pop-up wanted remote access. Bernard offered fruitcake instead, and the slipper stayed lost.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearRemote access requestUnsolicited contact

script exhausted, screen untouched · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                SafeNet Billing, this is the support line — you've reached us because of the warning on your screen, yes? I'll be quick, I just need to confirm that's what's showing.
              
                  Fake pop-up with phone numberFake authority or brand impersonation
                
It treats the pop-up as already proven and asks only for a small yes, so the person confirms the problem instead of questioning it.
Real company: A real company does not call you because of a warning on your screen, and it never treats a pop-up as proof of a problem.

                Bernard
                Oh — well — now, is that Scarfnet? There's a great red thing across the whole screen, yes, with a number on it. Hold on, I've knocked my slipper under the chair, the left one. Mavis is watching it go.
              
                Caller
                SafeNet Billing, yes. And that red thing is the warning — it means the machine is already compromised, so I'd leave the slipper and stay with me on this.
              
                  Urgency or fearFake pop-up with phone number
                
A visible red warning plus a claim of active harm makes people act fast and stop thinking.
Real company: A real security firm never cold-calls about a pop-up and never asks you to stay on the line.

                Bernard
                Compromised, is it. That's a big word for a Tuesday. My late wife used to say the radio was compromised when it did that crackling. Are you warm enough where you are, dear? It's turned bitter here.
              
                Caller
                Bitter here too, so let's not waste time — I'm the billing protection team at SafeNet, and that red warning is logged against your machine as of this morning. Just to confirm, it's still across the whole screen?
              
                  Fake authority or brand impersonationFake pop-up with phone number
                
A confident job title and a brand name make the warning feel official, so the listener accepts the problem as real.
Real company: A real security firm does not cold-call about a warning on your screen. You contact them through their published support number.

                Bernard
                Still across the whole screen, yes. I had a programme on lighthouses years ago, 1987 I think, and the sea came up over the lens like that — anyway. Billing, you said? I don't think I've ever billed anyone in my life.
              
                Caller
                Billing protection, and the record shows it's your billing profile that's flagged, not anything you did. Now then — if you'd just let me have a look at the machine, I can clear the whole thing off your screen.
              
                  Remote access requestFake authority or brand impersonationUrgency or fear
                
Asking to look at the machine sounds like help, and the offer to clear the problem makes handing over control feel like the fix.
Real company: A real company never asks to take remote control of your computer from an unexpected call. It would tell you to hang up and contact them through their official number.

                Bernard
                Have a look at it? You'd be very welcome, but the machine's in the back room and the kettle's just on. Do you take milk? And would you need feeding — I've a bit of fruitcake left.
              
                Caller
                No milk, no cake, thank you — I'm on a shift. And I don't need to come round, I just need you to let me look at the screen from here, that's all.
              
                  Remote access requestUnsolicited contact
                
It sounds casual and low effort, so the target thinks a quick screen share is harmless.
Real company: A real support team never asks to view your screen from a cold call, and will give you a number to call back.

                Bernard
                From there? Well, I never. Oh — hang on. My slipper's gone under the chair. One of them always does. Don't go away.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →