Security Guides
'Your PC is infected' warnings are almost always fake — how to close them, and what to do if you already called
A browser pop-up saying your PC is infected, with a phone number to call, is a tech support scam. Per Japan's IPA, seeing it doesn't mean you're infected. How to close it, and what to do at each stage if you called, allowed remote access or paid.
For: anyone who was browsing when a screen or alarm suddenly said "your computer is infected — call now", and is now worried. This article draws on official guidance from Japan's IPA (Information-technology Promotion Agency), Japan's National Police Agency, and Microsoft.
If the screen is showing right now, do just this
(1) Don't call the number. (2) Hold down the Esc key until a close button appears, and close the browser with it. On a tablet, long-press the screen and tap the × that appears at the top. If you still can't close it, restart the computer. If the screen was all that happened, you're done.
Telling a real warning from a fake one
Fake warning (tech support scam)
- Shown inside the browser, full screen
- A phone number, with pressure to call right now
- Alarms, voices or countdowns to raise panic
- Uses names and logos like "Microsoft" or "Windows" without permission
- Built to be hard to close
Genuine security features
- Appear as a notification from your OS or security software, not as a web page
- No phone number (Microsoft states its error and warning messages never include one)
- Resolved with buttons like "scan" or "quarantine"
- Never ask for payment in gift cards or cryptocurrency (also stated by Microsoft)
What to do depends on how far it went
The damage builds in stages. Work out how far you got, and do what that stage calls for.
Stage 1 — you only saw the screen
Not infected (IPA) → close it and you're done
Stage 2 — you called
The PC is still untouched → don't follow further instructions
Stage 3 — you installed remote-access software
They may have operated your PC → disconnect, remove, change passwords
Stage 4 — you paid
Ask to stop the payment → report to the police
Stage 1: you only saw the screen — close it and you're done
IPA says that if the screen merely appeared, the PC is not infected and closing the fake warning is enough. Hold down Esc until a close button appears and close the browser. IPA also offers a practice site (in Japanese) that mimics the real screen so you can rehearse closing it. If family members share the computer, a single practice run means nobody panics when it happens for real.
Stage 2: you called — don't follow any further instructions
If you only called and didn't install anything or pay, your computer has not been operated. The caller will say it's dangerous or that repairs cost money, to push you to the next stage. Hang up, don't answer if they call back, and don't do anything they told you to. If you gave them your name, address or card number, watch for follow-up contact that uses it.
Stage 3: you installed remote-access software — disconnect, remove, reset, change passwords
Japan's National Police Agency advises that you disconnect from the network, run a virus scan, uninstall the software you were told to install, reset the device if possible, and change your passwords. If you logged into online banking, email or shopping sites during the session, change those passwords from a different, safe device, and contact your bank straight away if an account is involved. A password manager is the realistic way to stop reusing passwords.
Stage 4: you paid — ask to stop the payment, then report it
The National Police Agency advises that you contact your card company to stop the payment if you paid by credit card, notify the issuer if you paid with electronic money or gift cards, and then report it to the police. Keep the gift card numbers and receipts.
This site's view: this scam attacks the person, not the computer
The fake warning is just a single web page shown in your browser. Nothing gets inside the computer, yet people lose money — because what it targets is not the machine but the anxiety of the person in front of it. Alarms, countdowns, screens that won't close: all of it is staged to take away your time to think and get you on the phone.
So one rule beats any technical fix: "a warning with a phone number is fake." Genuine security features never ask you to call. That rule is worth sharing with family — especially anyone unsure with computers. Someone who has seen a fake warning once and knows how to close it will not be caught by it again.
When you might really be infected
Separately from fake warnings, suspect a real infection if things like these persist: your security software itself reports a detection, programs or browser extensions you don't recognise appear, your browser's home page or search engine keeps changing on its own, or your accounts show sign-ins or sent messages you didn't make. Then disconnect from the network, scan with your security software, and consider resetting the device if needed. Types of malware and how they get in are covered in what is malware; how to check whether an account was taken over is in three places to check if you were hacked.
Sources
- IPA (Information-technology Promotion Agency, Japan): fake security warning (tech support scam) special page (updated 19 November 2024) — ipa.go.jp
- IPA: launch of the practice site for closing fake security warnings — ipa.go.jp
- National Police Agency, Japan: tech support scam countermeasures — npa.go.jp
- Microsoft: protect yourself from tech support scams — support.microsoft.com
Read next
- Terms: What is malware? / What is phishing?
- Checking for a takeover: Spam from your own address — three places to check
- The basics: Are password managers safe? / Which 2FA method is safest
FAQ
QA warning says my computer is infected. Is it?
If a page in your browser shows the warning and asks you to call a number, it is a tech support scam. Japan's IPA says that if the screen merely appeared, the PC is not infected, and closing the fake warning is enough.
QI can't close the fake warning. What do I do?
IPA recommends holding down the Esc key until a close button appears, then closing the browser. On a tablet, long-press the screen and tap the × that appears at the top. If that fails, restart the computer. Do not call the number shown.
QI already called the number.
If you only called and did not install remote-access software or pay, your computer has not been operated. Hang up, don't take further calls, and don't follow their instructions. You can talk to the police if you're worried.
QThey talked me into installing remote-access software.
Japan's National Police Agency advises disconnecting from the network, running a virus scan, uninstalling the software they had you install, resetting the device if possible, and changing your passwords. If you logged into online banking or email during the session, change those passwords from a different, safe device.
QI paid for 'support'.
The National Police Agency advises contacting your card company to stop the payment if you paid by credit card, or the e-money issuer if you paid with electronic money or gift cards, and then reporting it to the police. The sooner, the better the chance of stopping it.