A pop-up claiming your computer is infected, or that your bank account has been compromised, is almost always a tech support pop-up scam.
It is designed to panic you into calling a fake support number. In a growing number of 2026 cases, that first call has ended with victims withdrawing cash and buying physical gold bars for a scammer posing as a government courier.
Here is how the scam actually works, the warning signs, and what to do if you or someone you know already responded.
Never call the phone number shown in a pop-up warning, and never click anything on the page.
If the screen is locked, press Ctrl+Shift+Esc to open Task Manager and end the browser process, or restart the computer.
If you already called, installed remote-access software, or sent money or gold, disconnect from the internet, run a malware scan, change your passwords, and contact your bank immediately.
The scam usually begins with a full-screen pop-up in your browser, often triggered by a malicious ad or a compromised website. It imitates a Windows or Microsoft security alert, sometimes with a loud alarm sound, and claims your device is infected or that hackers have accessed your bank account.
The page displays a phone number and urges you to call immediately. It has not actually scanned your computer — it is a static webpage built to look like a system warning.
How It Escalates to Gold Bar Fraud
If you call, someone posing as Microsoft, Apple, or your bank walks you through installing remote-access software.
They then show fabricated “evidence” that your account has been hacked. A second caller may then impersonate the U.S. Treasury, a police department, or another federal agency.
It tells you the only way to protect your savings is to withdraw cash and convert it into gold bars, which a courier will collect for “safekeeping.”
The FBI reported more than $55 million in losses from courier-based cash and precious-metal scams between May and December 2023. That dated figure shows the scale of the pattern; it is not a running total for 2026.
Signs the Warning Is Fake
- A real Microsoft or Apple security alert never displays a phone number to call.
- Legitimate security software does not lock your browser in full-screen mode or play an alarm sound.
- Banks and government agencies never ask you to buy gold, gift cards, or cryptocurrency to “protect” your money.
- Urgency, countdown timers, and threats of arrest are scare tactics, not real enforcement procedures.
If You Already Called or Gave Remote Access
If you’re not sure whether you’re still affected, treat it as an active incident:
- Disconnect the device from Wi-Fi, or unplug the ethernet cable.
- Uninstall any remote-access program the caller told you to install.
- Run a full scan with Windows Security or a trusted antivirus tool; treat any program that installed itself during the call the same way you would other unwanted malware.
- Change your passwords from a different, trusted device, starting with email and banking, and turn on two-factor authentication where you can.
- Call your bank directly using the number on your card, not one given by the caller, and ask about freezing your account.
If anyone claiming to be from the government, a bank, or Microsoft asks you to withdraw cash, buy gold bars, or hand valuables to a courier, stop immediately and contact your local police non-emergency line. No legitimate agency collects money or valuables this way.
Removing Remote-Access Software a Scammer Installed
Open Settings > Apps > Installed apps and remove remote-access software the caller instructed you to install, such as AnyDesk or TeamViewer. These are legitimate tools that scammers can misuse, so antivirus software may not flag them. If you are unsure what changed, run a full Windows Security scan and ask a trusted technician to review recently installed apps.
Stopping the Pop-Ups From Coming Back
These warnings are typically triggered by malicious ads, not a genuine infection. Keep your browser updated, avoid clicking “Allow” on notification prompts from unfamiliar sites, and consider a reputable ad-blocker. If a pop-up locks your screen again, use Ctrl+Shift+Esc to end the browser process rather than interacting with the page.
See our full guide for other common scam patterns and how to avoid them.
Reporting the Scam
Report tech support scams to the Federal Trade Commission, and if money or gold changed hands, also file a report with the FBI’s Internet Crime Complaint Center (IC3). If a courier already collected cash or gold, contact your local police as well.
Frequently Asked Questions
Is this the same as a real antivirus warning?
No. A legitimate antivirus alert appears inside your existing security app, not as a full-screen browser pop-up with a phone number to call.
Can I remove the infection by just closing the tab?
In most cases, yes, because the pop-up itself is a webpage, not malware. If a program was actually installed during a call, closing the tab won’t remove it, so run a malware scan as well.
Why do scammers specifically ask for gold bars?
Gold is harder for banks to trace or reverse than a wire transfer, which is likely why prosecutors have reported a sharp rise in this method during 2026.
I gave a caller remote access but didn’t send any money. Am I still at risk?
Yes. Change your passwords and monitor your accounts closely, since the scammer may have viewed or copied personal information during the session.
Will my bank refund money sent to a scammer?
It depends on the payment method and your bank’s policies. Contact your bank immediately, since reporting it quickly improves the chance of recovery.
Bottom Line
Tech support pop-ups rely on panic, not real access to your computer. Recognizing the pattern early, and refusing to call, pay, or hand anything to a stranger, is the most effective defense against this and similar scams.
