Call #933 · 2026-10-28

The Pop-Up with a Phone Number

pop-up · SafeNet Billing · invented, like everything else here.

In real life: hang up. Nobody in this call can be followed as instructions. If a stranger rings and wants access to your computer, put the phone down and read the Help page, which is the part that is true.

Minutes wasted

Red flags found

Lines spoken

Scammer success

Call report

The Pop-Up with a Phone Number

A warning on your screen is not a company calling you, and no real support needs remote control of your machine to fix it.

“The infection was spreading by the minute, right up until the caller offered to post the fix instead.”

Fake pop-up with phone numberFake authority or brand impersonationUrgency or fearRemote access requestFake scan or planted problems

threat expired on its own, no access granted · scammer success: none

The call

Oldest line at the top. The note beside each caller line is the Fraud Desk.

                Caller
                Hello there, you're through to SafeNet Billing support, and I can see a warning has come up on your screen. That's the one you're ringing about, isn't it?
              
                  Fake pop-up with phone numberFake authority or brand impersonation
                
It assumes the reason for the call and sounds like a known company, so the person feels they reached the right place.
Real company: A real company does not put a phone number in a warning pop-up and wait for you to call it.

                Bernard
                Oh — well — now. Is that Sailboat Billing? There's a great deal of red on it, I will say. Hold on, the milkman's not been and I owe him two pounds, that's been on my mind all morning.
              
                Caller
                SafeNet Billing, yes. And I'd set the other matter aside for now, sir, because that red warning means the infection is active on your machine — every minute counts here.
              
                  Urgency or fearFake authority or brand impersonation
                
A ticking clock shuts down careful thinking, so the target acts before checking anything.
Real company: A real security firm never phones from a pop-up warning, and never tells you to drop everything and act now.

                Bernard
                Active, is it. Well I've got Wednesday all wrong, I'm sure today's Thursday, so the week's gone funny anyway. Have you eaten? You sound like a man who's skipped his lunch.
              
                Caller
                The day doesn't come into it, sir — what matters is that this is a genuine alert from SafeNet Billing and the infection is spreading as we speak. I really do need you to focus on the screen.
              
                  Fake authority or brand impersonationUrgency or fear
                
                Bernard
                I'm looking, I'm looking. Oh, I can't read it without my glasses — they'll be in the kitchen, or the hall. Wait, they're on my head, aren't they. There now. You were saying about the sailing?
              
                Caller
                Right — now that you can see it plainly, what I need is for you to let me have a look at that machine from here. If you just permit me the access, I can clear the whole thing off.
              
                  Remote access requestFake scan or planted problems
                
Offering to fix a problem he just convinced you exists makes handing over control feel like the helpful next step.
Real company: A real support team never takes remote control of your computer from an unexpected call. They ask you to contact them through official channels.

                Bernard
                Let me have a look at it from where? Are you local, then? Because if you're coming by, I'd put the pot on, and you could meet the bird — she's very good with visitors.
              
                Caller
                No, sir, nobody's coming by — I'm on the support side of SafeNet Billing, and I can only reach the machine remotely. So if you'd be willing to allow me that access now, we can settle this in a few minutes.
              
                  Remote access requestFake authority or brand impersonationUrgency or fear
                
                Bernard
                Remote, right. That's like the wireless, is it? Only mine goes off in the wind and I have to thump it. You'd be better off telling me what to press and I'll have a bash at it after my tea.
              
                Caller
                I'll send it in the post instead. Save us both the trouble. Goodbye.

What the pattern is

The warning is a web page, not a diagnosis. Anything can draw a red box and a siren, and the number in it belongs to whoever made the page. The alarm is designed to be frightening enough that the householder rings before thinking, and the person who answers has one job: get remote access, then charge for a "clean-up" that does nothing.

What to do instead

A browser warning is a web page and can always be closed. Do not ring the number on it. Close the tab or the window, and if the browser will not close, restart the computer. If a browser keeps doing it, clear the site data or ask someone you trust to look, using software you installed yourself.

The full scenario page →

Every call · Where to report a real one · ← previous · next →