How do you tell a real security alert from a fake one?

By where it comes from and what it asks for. Software installed on your machine alerts you from its own window, not from a web page, and it doesn't ask for payment to remove what it just detected. The urgency on display is also a giveaway: a genuine tool doesn't put you on a countdown clock.

The window won't close — is my computer locked?

No. It's the page blocking its own display, which the browser allows; the computer is working normally. Close the browser through the task manager, then reopen it without restoring the previous session.

What's the difference with fake tech support?

Scareware is software or a page selling you a solution; fake tech support is a person on the phone asking for control of your machine. The alert often serves as the opening move for the second by displaying a number, but the consequences differ: remote access granted is far more serious than an unnecessary purchase.

Scareware

In plain terms

A dramatic alert announces that your device is infected and offers the software that will fix it. The infection doesn't exist; the only malicious program in the whole story is the one being sold to you.

Definition

Scareware is software or a web page that manufactures an alarming security alert in order to get you to buy or install a supposed solution. This entry covers the software-based method; when a human caller contacts you or has you call them to get you to hand over control of your machine, that's fake tech support, which has its own entry. The two are frequently chained together, with the alert displaying a number to call.

How it works

The method exploits no technical flaw; it exploits fear, and its staging is designed for that: countdown, siren sound, imitation of a system window, a list of supposedly detected threats, sometimes a full-screen display that appears impossible to close. That sense of being locked is a property of the web page, not of your computer. Two details are usually enough to settle it: a genuine security program never announces a scan result from a browser page — it has no access to your files from there — and it doesn't ask for payment to remove what it just found. What follows depends on the scenario: either a payment for a product with no function, or the installation of a program that is, this time, genuinely malicious, or a number to call that leads to fake tech support.

Warning signs

Virus alert displayed in a web page or browser window
Countdown, alarm sound, or an apparent inability to close the window
Support phone number displayed in the alert message
Unknown product name, or one close to a known brand with one detail changed
Scan result announced instantly, before any check could actually happen
Payment requested to remove supposedly detected threats

How to verify

Ask yourself where the message is coming from. An alert shown by a browser tab can know nothing about your files. The decisive check is simple: close the window — if needed by closing the browser from the task manager — then reopen it without restoring the tabs. If the alert is gone, there was nothing. If you want to be certain, run a scan from the security software already installed on your machine, the one you open yourself.

What to do

Don't click anything in the window, not even the close button it offers, and don't call the number shown. Close the browser, then reopen it without restoring the tabs. Don't install or pay for any software offered by an alert you didn't trigger yourself.

If it already happened

If you paid, contact your bank to dispute the transaction and block it — the sooner you act, the more effective it is. If you installed the program, uninstall it and change, from another device, the passwords stored on that machine, since a fake security program was granted broad rights. If you called the number and gave control of your computer, the situation falls under the fake tech support entry. Report the incident to cybermalveillance.gouv.fr.

Frequently asked questions

How do you tell a real security alert from a fake one?: By where it comes from and what it asks for. Software installed on your machine alerts you from its own window, not from a web page, and it doesn't ask for payment to remove what it just detected. The urgency on display is also a giveaway: a genuine tool doesn't put you on a countdown clock.
The window won't close — is my computer locked?: No. It's the page blocking its own display, which the browser allows; the computer is working normally. Close the browser through the task manager, then reopen it without restoring the previous session.
What's the difference with fake tech support?: Scareware is software or a page selling you a solution; fake tech support is a person on the phone asking for control of your machine. The alert often serves as the opening move for the second by displaying a number, but the consequences differ: remote access granted is far more serious than an unnecessary purchase.

Official sources

Also known as: scareware, fake antivirus, alarmist software, fake virus alert.

This article is part of the Malware family. Last updated: 2026-09-03.