Scareware is a type of scam that uses fake security warnings to frighten you into downloading malicious software. Bad actors may use it to claim your device has a virus and urge you to click a link, call a number or pay for help.
A pop-up suddenly fills your screen: “Your PC Is Infected — Call Now!!”
There may be a loud warning sound, a countdown or a message telling you to contact Microsoft right away. These are common scareware tricks designed to make you panic and act before you have time to think.
Scareware has been used to trick people into paying for fake security services and unwanted charges. In one case, the Federal Trade Commission accused Jesta Digital of using fake virus alerts on Android phones that could lead to $9.99 monthly charges on users’ mobile bills.
The alert may be fake, but knowing that isn’t always easy when it appears on your screen. We’ll cover the signs to look for, what to do if you’ve already clicked and how to keep these fake alerts away.
How Does Scareware Differ From Ransomware and Phishing?
Scareware, ransomware and phishing can look similar because they all try to get something from you. The main difference is how they get your attention and what they want you to do next. Here are more details:
| Scareware | Ransomware | Phishing | |
|---|---|---|---|
| What it does | Type of malware that shows a fake warning claiming your device has a problem | Another type of malware that locks or encrypts your files so you can’t access them | A cybercrime where scammers use a fake email, text or website to trick you |
| How it reaches you | Pop-ups, fake alerts or malicious websites | Malicious files, links or infected software | Emails, text messages or fake websites |
| What it wants from you | Money, personal information or a click | Payment to restore access to your files | Passwords, payment details or other personal information |
| Biggest giveaway | An urgent warning tells you to call a number, click or pay | Your files suddenly become inaccessible, and a ransom demand appears | The message asks you to click a link or share sensitive information |
Scareware vs. Riskware vs. Grayware vs. Clickjacking
Unlike scareware, riskware is legitimate software that can create a security risk when someone misuses it. For example, a remote-access program can help with tech support but could also give a scammer access to your device.
Grayware refers to software that may behave in unwanted or questionable ways without being clearly malicious. It could show excessive ads, track your activity or change your browser settings.
Clickjacking tricks you into clicking something different from what you think you’re clicking. A malicious website might hide a button underneath an innocent-looking element, causing your click to trigger an unwanted action.
How to Spot a Fake Virus Alert
Fake virus alerts often look convincing at first. They may use security logos, warning sounds or official-looking language to make the message seem real. Look for these signs before you do anything.
1. Displays a Fake Security Warning
The alert may claim that your computer has detected a virus, hacked account or other security problem. It can look like a message from your antivirus software or another trusted company.
2. Creates a Sense of Urgency or Fear
Scareware wants you to panic. The message may say that your files are at risk, your personal information has been exposed or your computer will be damaged if you don’t act right away.
3. Prompts You to Take Immediate Action
The message may tell you to fix the problem immediately. And chances are, it might give you a countdown or warn that closing the window will make things worse.
4. Directs You to Click a Link, Download Software or Call a Number
The alert may offer a quick fix: asking you to download a program, click a button or call a phone number for technical support. These actions can expose you to online scams and fraud.
5. Steals Money or Sensitive Info, or Installs Malware
Once you follow the instructions, scammers may ask for payment or personal information. A download could also install malware on your device, giving cybercriminals another way to cause trouble.
Common Types of Scareware Scams
Scareware attacks can take several forms, but they all use fear to push you into making a quick decision. Some pretend to come from security companies, while others use official-looking warnings to seem trustworthy.
Here are some tactics that scammers use to trick you into downloading malware on your device:
- Fake antivirus pop-ups: These alerts claim your antivirus has found dangerous viruses on your device. They may ask you to click a button or pay for a fake security service.
- Fake tech support warnings: A pop-up may say your computer has a serious problem and tell you to call a support number. The person on the other end may ask for remote access or payment.
- Fake law enforcement notices: These messages pretend to come from the police or another government agency. They may claim you broke the law and demand a fine or payment.
- Fake system and browser update alerts: A website may tell you that your browser, operating system or another program needs an urgent update. Clicking the alert can lead to a malicious download.
- Fake account or payment alerts: A scam may claim that your account or payment has been compromised and ask you to verify your details. Sharing that information can put your data privacy at risk or lead to credit card fraud.
A Few Scareware Examples
Scareware has been around for years, and regulators have taken action against companies accused of using fake security warnings to trick people into paying for unnecessary software or support.
In 2019, the Federal Trade Commission (FTC) alleged that Office Depot and Support.com used a free PC Health Check program to tell customers their computers showed signs of malware. The companies agreed to pay $35 million to settle the FTC’s allegations.
The FTC also took action against Innovative Marketing, which sold scareware under names such as Winfixer. The agency said the company used fake system scans and alarming ads to convince 1 million+ people that their computers had serious problems. A federal appeals court later upheld a judgment of more than $163 million against marketer Kristy Ross.
Cases like this show how convincing fake security warnings can be. If you run a company, having an incident response plan can help you know what to do if you click a suspicious alert or think your device may be compromised.
What to Do if You See a Scareware Pop-Up
A scareware pop-up can make you want to fix the problem right away. If you think you’ve spotted one, use these tips to avoid giving the scammer access to your device or information:
- Avoid clicking buttons, links or “X” icons inside the warning. Some fake alerts use every part of the pop-up to trigger a download or open another malicious page.
- Try closing the browser using its normal close button. If the window won’t close, you may need to force the browser to quit and reopen it.
- Install available updates for your operating system and security software. Updates can fix security weaknesses that attackers may use to get onto your device.
- Don’t install anything unless you have verified that the software comes from a trusted source.
- Run a security scan using antivirus software like Panda Dome to check your device for malware. Taking this step can also help catch threats that may be hiding behind a fake warning, including malware such as DarkSide ransomware, which can encrypt your files and demand payment to restore access.
How to Remove Scareware
Don’t panic if a scareware pop-up has already appeared. You can remove the source of the problem with a few steps. However, the process looks a little different on Windows and Mac, so follow the respective instructions for your device.
On Windows
If you’ve seen a scareware alert on your Windows PC, start by getting the pop-up off your screen. Then work through these steps to check for anything the alert may have left behind:
- Press Ctrl + Shift + Esc to open Task Manager. Find your browser in the list, select it and choose End task to close the window without interacting with the pop-up.
- Turn off Wi-Fi or unplug your Ethernet cable. This cuts your device’s internet connection while you check for anything suspicious.
- Restart Windows in Safe Mode so it loads with only the essential programs and services. This can make it easier to remove unwanted software that starts with your computer.
- Open your installed apps and look for programs you don’t recognize or don’t remember installing. Remove anything suspicious, especially software that appeared around the time the scareware started.
- Use your trusted antivirus software to scan your entire device. Let the scan finish and follow the recommended steps if it finds a threat.
- Remove extensions you don’t recognize and clear your browser’s cache and website data. Check notification permissions, too, and remove access for unfamiliar websites that can send pop-ups.
On Mac
On a Mac, you can take a few simple steps to clear the scareware and check for anything suspicious. Start by closing the browser, then work through the checks below. Here are detailed instructions:
- Press Option + Command + Esc to open the Force Quit Applications window. Select your browser and choose Force Quit rather than clicking anything in the scareware alert.
- Open the browser again; don’t restore the previous session if prompted. This helps prevent the page containing the fake alert from loading again.
- Open the Applications folder and look for apps you don’t recognize. Move suspicious apps to the Trash, then empty the Trash.
- Open System Settings > General > Login Items & Extensions and review the apps allowed to open when you start your Mac. Remove anything you don’t recognize.
- Remove unfamiliar browser extensions and clear website data. Review your notification settings and block websites you don’t recognize from sending alerts.
- Use trusted anti-malware or security software to scan your Mac for malware. If the scan finds a threat, follow the software’s instructions to remove or quarantine it.
Protect Your Devices With Panda Security
A fake virus alert can turn an ordinary browsing session into a stressful few minutes. Panda Dome helps you stay protected by scanning your device for malware and other threats.
You can also use the antivirus to check your device after encountering a suspicious pop-up. Keep your security software updated, stay cautious with unexpected alerts and let us help protect your devices.
Try Panda Dome today and keep scareware out of your way.
Scareware FAQ
Scareware can look very convincing, especially when a warning uses familiar security terms or urgent language. These answers cover some common questions about how scareware works.
Can Scareware Damage My Computer?
Yes, scareware can lead to real problems if you follow the instructions in a fake alert. A download may install malware, while sharing payment details can expose you to fraud. Simply seeing a scareware message does not usually mean your computer is already infected.
Can You Get Scareware on a Phone?
Yes, scareware can appear on smartphones through malicious websites, apps or misleading advertisements. A fake warning may claim your phone has a virus and push you to download an app or provide personal information.
Is it Safe to Just Close the Pop-Up?
Yes, it’s usually safe to close pop-ups. Avoid clicking buttons or links inside the alert, even if the pop-up has a close button. If the window refuses to close, force quit the browser and reopen it without restoring the previous page.
How Can I Tell a Fake Virus Alert From a Real One?
Pay attention to how the warning reaches you and what it asks you to do. A pop-up that demands immediate payment, asks you to call a phone number or tells you to download software should raise suspicion. Knowing what “scareware” means can also help you recognize the tactic — scareware uses fear to push you into taking an action.
