Fake antivirus software, also called scareware, tries to look like security protection while pushing you to pay, call a number, or install more software. The alert is the trap, not the cure.
Does this affect you?
Use this on Windows, Mac, iPhone, or Android when a popup, webpage, email, or unknown program claims your device is infected and demands payment, a phone call, or a download.
Tell a fake alert from a real one
Where the alert appears matters.
- A warning inside a browser tab or webpage is not your operating system, even if it shows a Windows or Apple logo.
- Real antivirus programs do not ask you to call a phone number to remove a threat.
- Countdown timers, sirens, threats of permanent damage, and urgent claims about bank data or photos are pressure tactics.
- If a security program you do not remember installing suddenly appears, it may have been bundled with another download.
- For renewal emails, open the antivirus program or vendor website directly instead of clicking the message link.
Remove fake antivirus safely
Close and clean up from outside the suspicious window.
- Do not click buttons inside the popup, including fake close buttons.
- On Windows, use Task Manager with Ctrl+Shift+Esc. On Mac, use Force Quit with Command+Option+Esc. On phones, close the browser from the app switcher.
- Disconnect from the internet if you called the number, allowed remote access, or ran a download from the alert.
- Check installed apps or programs and uninstall anything unfamiliar.
- Run your real security tool: Windows Security on Windows, built-in protections plus a reputable scanner on Mac if needed.
- If you entered payment information or allowed remote access, change passwords from a clean device and contact your bank or card issuer.
Prevent it next time
Know what real protection you use and where software comes from.
- Use one antivirus you trust and learn what its normal alerts look like.
- Download software from official app stores or vendor websites typed directly.
- Keep a browser popup or ad blocker enabled.
- Never call a number shown in a browser alert.
- Keep the operating system and browser updated.
More control
Two endings are common
Scareware usually steals money through fake support or fake subscriptions, or it gets remote access and installs real malware. Both require panic-clicking.
Legitimate renewal notices exist
Security companies do send subscription emails. Verify by opening the app or typing the vendor website yourself.
Sources
- FTC Consumer Advice – Tech support scams (2025)
- CISA – Avoiding social engineering and phishing attacks (2024)
- Microsoft Support – Protect yourself from tech support scams (2025)