Bernard Doesn't Press That The Fraud Desk
Line quiet

Call #63 · 2026-10-18

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

15
Minutes wasted
4
Red flags found
10
Lines spoken
0
Scammer success
Call report

The Pop-Up with a Phone Number

A warning on your screen is not a phone call, and no real support line needs the code off it.

“The warning was still there, the code was never read, and the caller never reached the machine.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearRemote access request

script exhausted, no access, slipper recovered · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

Caller SafeNet Billing, good afternoon. I understand you've got a warning on your screen — that'll be why you called, so I'll be quick.
Fake pop-up with phone numberFake authority or brand impersonation

It confirms the screen warning as real and frames the call as the fix, so the target trusts the voice on the phone.

Real company: A real security firm never puts a phone number in a warning pop-up, and never calls you about it.

Bernard Oh — well — now, is that SafeNest? With an "n"? Only my neighbour's got a nest box, blue tits, and I wondered if it was the same sort of firm. And there's a warning, yes, big red thing. Would you like a cup of tea while we sort it?
Caller SafeNet, with a t, no nest boxes, I'm afraid. Look, that big red warning means the machine's compromised right now, so we do need to move quickly before anything else happens.
Urgency or fearFake pop-up with phone numberFake authority or brand impersonation

A scary warning plus a ticking clock pushes people to act before they stop to check whether the warning is real.

Real company: A real security firm never cold-calls about a pop-up, and real software shows warnings inside its own app, not with a phone number to ring.

Bernard Compromised. That's a lovely word, isn't it. Now, before anything else happens — hold on, I've lost a slipper, it's gone right under the chair. Won't be a moment. Big red thing's still there, mind, I've not touched it.
Caller That's great news, don't touch it, leave it exactly as it is. Now, I'm calling for SafeNet Billing, and I'll be quick — the warning on your screen means this is a priority case, so I need you to stay with me on the machine.
Fake authority or brand impersonationUrgency or fear

A confident company name plus a stated priority case makes the warning feel official and time-sensitive, so people comply before checking.

Real company: A real billing company contacts you through your own account or statement, not a number from a pop-up.

Bernard Priority case, right you are. Did you say billing, though? Because I've not had a bill from you, and my late wife — no, hang on, it was my sister, Doris — she said never pay a bill that arrives red. Or was it never pay in red ink. Either way.
Caller Billing, yes, that's the department. But never mind bills for now — the warning on your screen is the urgent bit, and it's got a support code on it that I need you to look at.
Remote access requestUrgency or fearFake pop-up with phone number

It steers attention away from the reason for the call and toward a scary warning, so the person focuses on fixing the problem instead of questioning the caller.

Real company: A real support team would identify themselves, give a reference number, and never treat a screen warning as a reason to act on a call.

Bernard A support code. Oh dear, I'm not much good with codes — I couldn't get the telly off the shopping channel for a fortnight. What colour's the code? Only my reading glasses are somewhere in the kitchen.
Caller It's the box of text on the warning, near the bottom, and I really do need those numbers off it. I'll be quick — just read them to me and we can get this closed off before it spreads.
Remote access requestUrgency or fear

A calm, helpful tone plus a ticking-clock threat makes reading out a code feel like a small favour that solves the problem.

Real company: A real security team never asks you to read codes off a warning box to them, and would point you to official support channels.

Bernard Spreads, does it? Like damp. Mind you, my neighbour had damp and it was the guttering. Was it the guttering, do you think? Only Mavis is staring at the screen now, and she's not keen on red.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →