Do not call the phone number, click the alert, download a repair tool, or give anyone remote access. Microsoft says its error and warning messages never include phone numbers, and it does not make unsolicited calls or send unsolicited messages to fix your computer. A countdown, siren, full-screen page, or claim that your device is locked does not change that.
If you have not called, downloaded anything, entered information, or granted access, focus first on closing the deceptive page. The pop-up is designed to create panic; it is not reliable proof that Microsoft detected malware, that your files are exposed, or that you owe money for support.
Close the alert without using its buttons
Try leaving full-screen mode and closing the browser tab or window through the browser controls. If the page traps the pointer or keeps reopening dialogs, force-quit the browser with your operating system’s task manager or restart the computer. Do not click an alert button labeled close, scan, cancel, renew, or continue because the page controls what those buttons do.
After reopening the browser, decline any offer to restore the suspicious tab. Update Windows and the browser, then run a full scan with Windows Security. Remove anything the trusted security scan identifies. Download tools only from Microsoft, the Microsoft Store, or another vendor’s verified official site — never from the alert or a search ad that imitates support.
If someone had remote access
End the remote session and disconnect the computer from the internet so the person cannot continue controlling it while you respond. Uninstall remote-access applications the scammer asked you to install, run a full Windows Security scan, and apply available security updates. Microsoft says a Windows reset may be appropriate in serious cases; back up essential files and use official recovery guidance.
Do not let the same caller reconnect to “finish cleanup” or issue a refund. If you are unsure whether access remains, stop using that computer for banking, email recovery, or password changes until it has been checked by a technician you selected independently. Tell the technician exactly which application was installed and how long the session lasted.
Secure accounts and challenge suspicious payments
From a device you trust, change any password you typed or revealed, starting with email, Microsoft, banking, and password-manager accounts. Change reused passwords too, review account recovery details and recent sign-ins, end unfamiliar sessions, and enable multi-factor authentication. If you disclosed card or bank information, contact the issuer through its official channel and monitor the account.
If you paid, contact the card issuer, bank, wire service, gift-card company, cryptocurrency platform, or payment app immediately. Explain how you paid and ask whether a reversal, dispute, freeze, or recall remains possible. Keep the receipt and gift card if one was involved. Acting quickly is worthwhile, but neither Microsoft nor the FTC says every tech-support payment can be recovered.
Report the scam and ignore the refund sequel
Save a screenshot or photo of the alert, its website address, the phone number, payment instructions, receipts, and the name of any remote-access software. Report the incident at ReportFraud.ftc.gov and use Microsoft’s official reporting options for tech-support scams or unsafe sites. Do not revisit the scam page just to collect evidence.
Expect a second approach claiming that Microsoft, a bank, or a recovery specialist owes you a refund. The FTC documents refund scams that use fake overpayments to demand gift cards, bank transfers, cryptocurrency, or payment-app transfers. Verify any real charge on your statement and contact the company through a number you find independently, never through the refund message.
Frequently asked questions
Does a real Microsoft warning include a phone number?
Microsoft says its error and warning messages do not include phone numbers. Do not call a number in a pop-up or download a tool offered by the alert.
What if the fake alert will not let me close the browser?
Use operating-system controls to force-quit the browser or restart the computer. Reopen without restoring the suspicious tab, update the browser and Windows, and run a full scan with Windows Security.
What should I do if I gave the caller remote access?
End the session, disconnect the computer from the internet, remove the remote-access software, and scan and update the device. Use a separate trusted device to secure passwords and financial accounts.
Sources and further help
Reviewed
