Call #778 · 2026-10-26

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning that appears on your screen is not a phone call. Real support does not ring you off a pop-up and ask to be let in.

“The caller asked to be let onto the machine from their end, and Bernard said he had a programme half on.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearFake scan or planted problemsRemote access request

no entry given, red box still up, they rang off · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                Hello, that's right, you're through to SafeNet Billing support — I can see the warning that's on your screen right now, so let's sort it before it gets any worse.
              
                  Fake pop-up with phone numberFake authority or brand impersonationUrgency or fear
                
Claiming to already see the warning makes the call feel connected to the screen, so the fear feels real and personal.
Real company: A real security company does not cold-call about a pop-up, and never claims to see your screen without your permission.

                Bernard
                Oh — well — now, you can see it, can you? That's clever. Mine's just a big red sort of a box, I can't make head nor tail of it. Frightful colour, really. Did you paint it yourself, or does it come like that?
              
                Caller
                I couldn't tell you who painted it, sir — what matters is that red box means your machine's compromised this very moment, and every minute it sits there makes it worse. Let me help you get ahead of it.
              
                  Urgency or fearFake scan or planted problems
                
A ticking clock shuts down careful thinking, so the target acts fast to stop a threat that does not exist.
Real company: A real security team states the facts plainly and never pressures you to act within minutes.

                Bernard
                Worse, is it? Hmm. Well, it's been sat there since Tuesday and nothing's caught fire. Oh — the neighbour's cat's been at my fence again, took a whole slat off. Would you credit it? Little ginger thing.
              
                Caller
                A cat's got nothing to do with the red box, sir — this is a formal notice from SafeNet Billing and I need you to treat it as one. Your machine's been flagging itself for days now, which is precisely the problem.
              
                  Fake authority or brand impersonationFake scan or planted problems
                
                Bernard
                SafeBelt, did you say? Sorry, my left ear's a bit off. Flagging itself, you say — that'll be the little light does that. Do you want me to read it out to you, or shall I fetch my specs?
              
                Caller
                SafeNet Billing, yes — and you won't need the specs, because it's not something to read. Here's the part that matters: I need you to let me have a look at your machine from this end, so I'm going to ask you to let me in.
              
                  Remote access requestFake authority or brand impersonation
                
Asking to connect in and look around sounds like helpful support, so the victim lowers their guard and hands over control.
Real company: A real company never asks to connect to your computer from an unsolicited call. You call them, through a number you look up yourself.

                Bernard
                Let you in — well, you'd have to come round the side, the front gate sticks. Oh, but you're on the phone, aren't you. Sorry, it's been a long day. Are you eating properly, wherever it is you're sat?
              
                Caller
                SafeNet Billing, sir, and it's not the light I mean. Just let me onto your machine from my end and we'll deal with the red box.
              
                  Remote access requestFake authority or brand impersonation
                
                Bernard
                Oh, the machine. No, I shan't be doing that tonight, I've a programme half on. Hold on — hold on. There's a whistling. It's my ear, it does that when I cup it. Can you hear that?
              
                Caller
                I'll get someone else to ring you. Goodbye.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →