Call #853 · 2026-10-27

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning on your screen is not a phone number, and no security officer will ring you off it to get inside your machine.

“Bernard asked whether letting him look would need a person present, and offered to put the phone down for a biscuit.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearFake scan or planted problemsRemote access request

walk unfinished, access never granted, caller rang off · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                That's the number off the warning that's sitting on your screen right now — I can see it flagged on my side, so you've done the right thing ringing it.
              
                  Fake pop-up with phone numberFake authority or brand impersonation
                
It makes the number on the screen feel official and pre-approved, so the target trusts the call instead of questioning it.
Real company: A real company never puts a phone number in a warning pop-up and never confirms it as genuine over the phone.

                Bernard
                Oh, the warning — yes, it's still up there, big orange thing. I did wonder if I'd done something to annoy it. My slipper's gone under the chair, you see, so I was down on my knees, and when I sat back up there it was. Would you like a cup of something while you're on?
              
                Caller
                No, no, keep your mind on the screen, because that orange warning means the problem is spreading as we speak. Every minute it sits there it's getting a bit further into the machine.
              
                  Urgency or fearFake pop-up with phone number
                
A ticking clock shuts down careful thinking, so people act fast to stop a threat that is not real.
Real company: A real software company shows a plain error message and never asks you to call a number on a pop-up.

                Bernard
                Spreading? Well, I had a programme about lighthouses on years ago, nineteen eighty-seven I think, and that spread too — all over the schedule, you couldn't get away from it. Is it like that, or more of a damp-patch sort of spreading?
              
                Caller
                This isn't a programme, this is a bit more serious than that, and as a SafeNet Billing security officer I'd rather we dealt with it before it gets worse. The warning is telling us the machine has been compromised.
              
                  Fake authority or brand impersonationUrgency or fearFake scan or planted problems
                
A made-up job title and a vague threat make the warning feel official and urgent, so people stop questioning it.
Real company: A real billing company never calls about a pop-up warning and never claims to be a security officer over the phone.

                Bernard
                SafeNet, right. I'd got it as SafeNest — I don't know why, it just sounded cosier. Anyway, compromised, you said. Is that the bit on the screen with the shouting, or is there more of it below the fold?
              
                Caller
                Doesn't matter what it's called, the point is I need to get into your machine to see what this warning's done, so if you'd just let me have a look at it we can get this sorted.
              
                  Remote access requestFake scan or planted problems
                
Offering to fix a scary problem makes letting a stranger in feel like the helpful next step.
Real company: A real software company never asks to connect into your computer from an unexpected call.

                Bernard
                Oh — well — now, letting you have a look. Is that the sort of thing where I'd need to be here in person, or could we do it after? Only I've got a chair I need to have a word with about a slipper.
              
                Caller
                You'd need to be there, yes, right in front of the machine, because I can't do any of this without getting onto it. It's a quick job if we start now.
              
                  Remote access requestUrgency or fear
                
                Bernard
                Right you are. Only the machine's in the back room and I'm in the front room, so there's a bit of a walk between us. Would you hold while I have a biscuit?
              
                Caller
                I'll ring you back another day. Bye now.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →