Fake Microsoft pop-up saying "call this number": what to do

A pop-up says your PC is infected and to call Microsoft? It's a scam. Here's what to do right now, and what to do if you already let the caller in.

By the Xcelcor Guardian team · Updated October 13, 2026

If a pop-up says your computer is infected, locked or "compromised" and tells you to call a Microsoft number, it's a scam. Microsoft doesn't put phone numbers in warning pop-ups. Don't call. Close the browser, and if it won't close, restart the PC.

What the pop-up usually says

These pages often fill the whole screen, play a loud alarm or a recorded voice, and show a fake Windows or "Windows Defender" logo. Common lines are "Your computer has been blocked", "Do not restart your computer" and "Call Microsoft Support" with a toll-free number. Some show your IP address to look official. None of this means your PC is really infected. It's a web page.

Is the pop-up real?

No. Microsoft says its error and warning messages never include a phone number, and that it doesn't call people out of the blue to offer support (Microsoft Support). A real Windows Security alert shows up in the Windows Security app or as a small notice near the clock, not as a full-screen web page with an alarm.

A few signs it's fake:

It appears while you're browsing, inside Chrome, Edge or Firefox.
It shows a phone number and tells you to call now.
It says not to turn off or restart your computer.
It plays a sound or a voice and won't let you close the tab.

If you're not sure, don't use anything on the pop-up. Close the browser as shown above, then open the Windows Security app from the Start menu and run a quick scan. If that scan finds nothing, the warning was only a web page.

How to close it

Press Ctrl + Shift + Esc to open Task Manager.
Click your browser (Chrome, Edge or Firefox) and choose End task.
When you open the browser again, don't restore the old tabs.

If that doesn't work, hold the power button until the PC turns off, then turn it back on.

If you already called

The caller's next step is almost always to ask you to install a program such as AnyDesk, TeamViewer or Quick Assist, or to read out a code. That gives them control of your computer. If you haven't done that yet, hang up. A real Microsoft employee won't call you back.

If you already let them in

This happens to careful people every day. The callers are trained and persuasive. What matters now is acting quickly:

Disconnect the PC from the internet (unplug the cable or turn off Wi-Fi).
Hang up.
Call your bank from another phone, using the number on the back of your card.
Change your email password from another device.
Follow our two-minute checklist.

Then report it at ReportFraud.ftc.gov and ic3.gov. You can also tell Microsoft at microsoft.com/reportascam.

How common this is

The FBI's IC3 2025 Internet Crime Report lists 47,794 tech-support scam complaints and $2,134,675,818 in reported losses, about $44,000 per complaint (IC3 2025 report).

Making the next attempt harder

The scam only works when someone at the PC lets the caller connect. Xcelcor Guardian is a Windows 11 app that holds every new remote connection (AnyDesk, TeamViewer, Quick Assist, ScreenConnect, RDP and others) until the account holder, often a son or daughter, approves it by email or on xcelcor.com. The PC itself only has a Refuse button. It doesn't see the screen, files, passwords or banking, and it works alongside your antivirus. It lowers the risk, but it doesn't stop every scam. You can try it free for 14 days on one PC, no card needed.

Last updated October 13, 2026