Security Guides

#tech support scam #fake warning #malware #remote access #personal security

'Your PC is infected' warnings are almost always fake: how to close them, and what to do if you already called

A browser pop-up saying your PC is infected, with a number to call, is a tech support scam. How to close it, and what to do if you called or allowed access.

Published 2026-09-26 Updated 2026-10-06 Last verified 2026-09-26 8 min read

On this page

For: anyone who was browsing when a screen or alarm suddenly said "your computer is infected — call now", and is now worried. This article draws on official guidance from Japan's IPA (Information-technology Promotion Agency), Japan's National Police Agency, and Microsoft.

If the screen is showing right now, do just this

(1) Don't call the number. (2) Hold down the Esc key until a close button appears, and close the browser with it. On a tablet, long-press the screen and tap the × that appears at the top. If you still can't close it, force the browser to quit (steps below) or restart the computer. If the screen was all that happened, you're done.

If it won't close (the screen seems frozen)

If holding Esc doesn't bring up a close button, quit the whole browser.

Windows: press Ctrl, Alt and Delete together, open Task Manager, right-click your browser (Chrome, Edge and so on) and choose End task (as Japan's National Police Agency advises)
Mac: press Option, Command and Esc together, select the browser in the Force Quit window, and click Force Quit (as Apple describes)
If neither works, restart the computer

When you next open the browser, if it offers to restore your previous pages, don't. That would reopen the fake warning.

Is the "virus" notification in the lower-right corner real?

If notifications like "virus detected" or "critical virus alert" keep appearing in the lower-right corner of your screen, they are usually fake warnings sent through your browser's notification feature. If you once clicked "Allow" when a site asked to show notifications, that site can keep sending them even when the browser is closed. Microsoft notes that website notifications appear in the lower-right corner of the screen and in the notification center.

Fake: the sender shown is a browser (Google Chrome, Microsoft Edge) or a website address, and clicking it opens a fake warning page
Genuine: the sender shown is "Windows Security", with no phone number. Open Windows Security from the Start menu to check for yourself whether anything was really detected

To stop fake notifications, block that site's notifications.

Chrome: "⋮" at the top right > Settings > Privacy and security > Site settings > Notifications, then set unfamiliar sites to "Don't allow" or remove them
Edge: "…" at the top right > Settings > Privacy, search, and services > Site permissions, choose the site, and set Notifications to "Block"
In either browser, you can also open the site, click the icon to the left of the address bar, and set notifications to Block

Telling a real warning from a fake one

Fake warning (tech support scam)

Shown inside the browser, full screen
A phone number, with pressure to call right now
Alarms, voices or countdowns to raise panic
Uses names and logos like "Microsoft" or "Windows" without permission
Built to be hard to close

Genuine security features

Appear as a notification from your OS or security software, not as a web page
No phone number (Microsoft states its error and warning messages never include one)
Resolved with buttons like "scan" or "quarantine"
Never ask for payment in gift cards or cryptocurrency (also stated by Microsoft)

What to do depends on how far it went

The damage builds in stages. Work out how far you got, and do what that stage calls for.

Stage 1 — you only saw the screen

Not infected (IPA) → close it and you're done

Stage 2 — you called

The PC is still untouched → don't follow further instructions

Stage 3 — you installed remote-access software

They may have operated your PC → disconnect, remove, change passwords

Stage 4 — you paid

Ask to stop the payment → report to the police

Tech support scams escalate in stages. Where it stopped decides what you need to do.

Stage 1: you only saw the screen — close it and you're done

IPA says that if the screen merely appeared, the PC is not infected and closing the fake warning is enough. Hold down Esc until a close button appears and close the browser. IPA also offers a practice site (in Japanese) that mimics the real screen so you can rehearse closing it. If family members share the computer, a single practice run means nobody panics when it happens for real.

Stage 2: you called — don't follow any further instructions

If you only called and didn't install anything or pay, your computer has not been operated. The caller will say it's dangerous or that repairs cost money, to push you to the next stage. Hang up, don't answer if they call back, and don't do anything they told you to. If you gave them your name, address or card number, watch for follow-up contact that uses it.

Stage 3: you installed remote-access software — disconnect, remove, reset, change passwords

Japan's National Police Agency advises that you disconnect from the network, run a virus scan, uninstall the software you were told to install, reset the device if possible, and change your passwords. If you logged into online banking, email or shopping sites during the session, change those passwords from a different, safe device, and contact your bank straight away if an account is involved. A password manager is the realistic way to stop reusing passwords.

Stage 4: you paid — ask to stop the payment, then report it

The National Police Agency advises the following:

If you paid by credit card, contact your card company to stop the payment
If you paid with electronic money or gift cards, notify the issuer
Then report it to the police Keep the gift card numbers and receipts.

This site's view: this scam attacks the person, not the computer

The fake warning is just a single web page shown in your browser. Nothing gets inside the computer, yet people lose money — because what it targets is not the machine but the anxiety of the person in front of it. Alarms, countdowns, screens that won't close: all of it is designed to take away your time to think and get you on the phone.

So one rule beats any technical fix: "a warning with a phone number is fake." Genuine security features never ask you to call. That rule is worth sharing with family — especially anyone unsure with computers. Someone who has seen a fake warning once and knows how to close it will not be caught by it again.

When you might really be infected

Separately from fake warnings, suspect a real infection if things like these persist:

Your security software itself reports a detection
Programs or browser extensions you don't recognise appear
Your browser's home page or search engine keeps changing on its own
Your accounts show sign-ins or sent messages you didn't make

Then disconnect from the network, scan with your security software, and consider resetting the device if needed. Types of malware and how they get in are covered in what is malware; how to check whether an account was taken over is in three places to check if you were hacked.

Sources

IPA (Information-technology Promotion Agency, Japan): fake security warning (tech support scam) special page (updated 19 November 2024) — ipa.go.jp
IPA: launch of the practice site for closing fake security warnings — ipa.go.jp
National Police Agency, Japan: tech support scam countermeasures — npa.go.jp
Google Chrome Help: use notifications to get alerts — support.google.com
Microsoft: manage website notifications in Microsoft Edge — support.microsoft.com
Apple: how to force an app to quit on Mac — support.apple.com
Microsoft: protect yourself from tech support scams — support.microsoft.com

FAQ

QA warning says my computer is infected. Is it?

If a page in your browser shows the warning and asks you to call a number, it is a tech support scam. Japan's IPA says that if the screen merely appeared, the PC is not infected, and closing the fake warning is enough.

QI can't close the fake warning. What do I do?

IPA recommends holding down the Esc key until a close button appears, then closing the browser. If that doesn't work, on Windows press Ctrl, Alt and Delete together, open Task Manager, right-click the browser and choose End task (as Japan's National Police Agency advises). On a Mac, press Option, Command and Esc together, select the browser and click Force Quit. If that fails too, restart the computer. On a tablet, long-press the screen and tap the × that appears at the top. Do not call the number shown.

QA 'virus detected' notification keeps popping up in the lower-right corner of my screen.

Usually this is a fake warning sent by a website you once allowed to show browser notifications. If the notification shows a browser name or a website address, it is not a Windows warning. Block that site's notifications: in Chrome, go to Settings > Privacy and security > Site settings > Notifications; in Edge, go to Settings > Privacy, search, and services > Site permissions.

QA screen says 'this PC has been blocked' and gives a number to call. Should I call it?

No. A screen that says your PC has been locked or blocked and tells you to call a number is a tech support scam. Microsoft says its error and warning messages never include a phone number. Close the screen and you're done.

QI already called the number.

If you only called and did not install remote-access software or pay, your computer has not been operated. Hang up, don't take further calls, and don't follow their instructions. You can talk to the police if you're worried.

QThey talked me into installing remote-access software.

Japan's National Police Agency advises disconnecting from the network, running a virus scan, uninstalling the software they had you install, resetting the device if possible, and changing your passwords. If you logged into online banking or email during the session, change those passwords from a different, safe device.

QI paid for 'support'.

The National Police Agency advises contacting your card company to stop the payment if you paid by credit card, or the e-money issuer if you paid with electronic money or gift cards, and then reporting it to the police. The sooner, the better the chance of stopping it.