What I’m about to discuss can take a couple different forms. The more jarring of them is when your computer locks up and displays a warning that it’s been locked down, because it was hacked, or has a virus, or you’ve done something illegal on it, or almost anything else. It may say this was done by Microsoft, or McAfee, or by “Windows Support,” or something of that kind. It includes a phone number you must call to clear up what’s wrong and unlock your computer. Often what’s on the screen will be accompanied by a voice ordering you not to turn your computer off and immediately call the phone number.
Here’s a sample of what your screen may look like:
I call these “scare alerts.” Microsoft calls them “tech support scams.” On a technical level, they’re “browser hijacks” because the browser is running a malicious script that essentially takes it over.
The other form of these is when someone calls you to tell you that your computer is being locked down, because it was hacked, has a virus, you’ve done something illegal, etc. The person will identify him or herself as being from Microsoft, or Norton, or “Network Support,” etc.
Whichever of these you encounter, it’s important for you to know: However you name these “warnings,” they are lies! Microsoft, or McAfee, or Norton, or whoever hasn’t discovered you were hacked, or were doing something illegal. Do not call the phone number in this warning! No one who answers is going to help you. Far from it; instead, they will rob you!
The most fundamental rule of dealing with these situations is: Do not engage with these cybercrooks. They know what they’re doing. They can rob people blind, and they have done so. Even people who’re technically savvy and know better. Older folks tend to be taken in by these scams (particularly the phoned-in kind), so let your elderly friends and relatives who are online know about this. Yes, even if they have a lot of technical know-how.
If you get one of these pages that audibly instructs you not to shut off your computer, do not obey what you see and hear. I mean it! Don’t do anything you’re told to, on your screen, by the announcement coming from the computer, or instructed by whoever called you, in the case when the “scare” was phoned in.
A quick way out of this, on a Windows computer, is to hit Control-Alt-Delete on your keyboard, then click Task Manager, then in the list of Apps or Processes you see, terminate your browser. It might be Chrome, or Edge, or Firefox. Whatever it is, right-click on it and click “End task.” It will go away.
On a Mac computer, hold down the Option key (might also have “Alt” on it) and while doing that click your browser’s icon in the Dock at the bottom of the screen (it might be Safari, Chrome, etc.). A small menu will pop up; click “Force Quit” in that. It will go away.
Or, restart your computer: In Windows, hit Control-Alt-Delete, at the bottom right, you’ll see a power control; click on that, and restart. On a Mac you should be able to do this by clicking on the Apple icon and clicking Shut Down.
If you got a phone call, don’t say a word, just hang up. The person may call back immediately or within a few minutes; do not pick up. Block the phone number, if possible. You do not want to speak to this person, or even let them get the idea your phone number will lead them to a live person.
If your computer was hit by one of these “scare alert” browser hijacks and you exited it as suggested above, in 98% of cases, you’ll be fine. It might be worthwhile to do an on-demand virus scan, but honestly, it’s doubtful any malicious code was installed on your computer. The bad guys’ goal was to get you to call that phone number. As long as you didn’t do that, you should be fine.
In the case of one of these browser hijacks, on a Window computer, and assuming you use Windows Defender as your antivirus, you may want to perform a precautionary scan, just to be sure nothing malicious was left behind by this event. To do that:
For Macs, we’ve long recommended Sophos’s antivirus for Mac (https://home.sophos.com/en-us/download-mac-security). We also now recommend, alternatively, Intego Internet Security for Mac (https://www.intego.com/). Assuming you have either of those, open it and have it scan your computer.
A second-opinion scan may also be worth your time. You can use any of these:
It goes without saying, don’t search the Web for any of these! Just go directly to these links. For each of these, download the program and run it. In the case of Malwarebytes it will install the program, then you can launch it and have it scan your computer. The other two are scanner applications themselves. Also, when you’ve finished scanning your computer, remove whichever of these you used. They don’t need to be left behind.
Whichever of these you use, have it quarantine anything it finds, then reboot. It’s very possible, as I noted above, that no malicious software will be found.
When you’re done, uninstall Malwarebytes and remove HouseCall or ESET Scanner if they’ve been left on your computer. You no longer need them.
An additional tool to help prevent these scams is OpenDNS, which we’ve advised consumers use for years: Setting Up Web Filtering & Shielding.
Or use Cloudflare’s DNS: https://developers.cloudflare.com/1.1.1.1/setup/ (click on the “Block malware” section)
These DNS-filtering solutions can’t prevent all of these scams, but they’re a big help.
You may wonder why your browser was hijacked, in spite of having antivirus, and the reason is simple: Your computer didn’t encounter any code that it would detect as a virus or related malware.
What happened was that your browser went to a site which had a script, and ran it. This script literally told the browser to display the graphics and text you saw on the screen, make the announcement you heard, and not respond to your input. It’s in the very nature of Web browser software to display text and graphics and stream sound. Antivirus software has no idea that the content of the text, graphics, and sound are fraudulent.
If you did happen to engage with these cybercrooks and were scammed by them, here’s what you should do:
Details matter; one example is the phone number the crooks either called you from or told you to call. Cybercrooks can spoof phone numbers, but if a call was actually made, telecom company records may still allow them to be backtracked, at least to a point.
Microsoft’s Web page about tech support scams: https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435
Consumer Reports article about online scams in general: https://www.consumerreports.org/money/scams-fraud/how-to-protect-yourself-from-scams-and-fraud-a6839928990/
ABC News article about this: https://abcnews.go.com/GMA/Living/fbi-warns-rise-costly-technical-support-scams/story?id=94165053
FTC’s advice on these: https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams
Get the word out. Don’t be taken. And whatever you do, never engage these cybercrooks at all. Just don’t do it.