Security & Privacy / Malware Troubleshooting
How to Recognize Fake Windows Security Warnings
Quick answer
Microsoft will not call you from a webpage, and Windows Security does not cover the whole screen with a red countdown and a phone number. Close the browser from Task Manager (Ctrl+Shift+Esc) if the page trapped you. Do not call the number, do not allow remote access, do not enter a card. Then scan with the real Windows Security app from the Start menu, not from the scare page.
Quick diagnosis
If several of these match what you see, you are in the right guide.
- A full-screen page says Windows Defender found hundreds of viruses
- A voice or popup tells you to call a phone number
- The browser will not close and plays an alarm
- A download named update.exe or security-fix after a scare page
Possible causes
- A malicious or compromised website
- A browser notification permission you granted to a fake "alert" site
- An unwanted extension
- Actual malware that opened the page, possible, but the page itself is still not Microsoft
- A phone scam that started from the same playbook
What you need
- Task Manager
- Windows Security (the real one in Settings)
What this problem usually means
Real Windows Security lives in Settings and in the Windows Security app. It does not need a support line on the page. Full-screen browser kiosks use JavaScript and notification APIs to look official. They are not a BIOS infection and not proof that Windows is "locked."
If the whole desktop is black and Task Manager will not open, that may be black screen after login or real malware, still do not use a phone number from a popup.
Before you start
- If you already called and gave remote access, assume the session is hostile: hang up, disconnect the PC from the network, and consider a professional cleanup. Passwords used during the call should be changed from a different device; the password strength checker can help you evaluate new passwords locally in your browser.
- Do not pay a "refund" to the same number to make it stop.
Quick fixes
1. Kill the browser, do not click inside the page
- Ctrl+Shift+Esc (Task Manager).
- End Microsoft Edge, Google Chrome, or Firefox, whichever is full screen.
- If the mouse is captured, Ctrl+Alt+Delete → Task Manager from that screen.
- Do not press Allow on any further notification prompts from that site.
2. Clear the trap notifications
In the real browser (after a clean start): Settings → Notifications / Site settings → Notifications. Remove sites you do not recognize. Scareware often survives a tab close because it was granted notification permission.
Step-by-step troubleshooting
Scan with Windows Security, launched from Start, not the webpage
Start → Windows Security → Virus & threat protection → Quick scan, then a Full scan if you downloaded anything the page offered. That is the Microsoft app. Anything that popped over the browser is not that app.
Extensions and hijacked search
Remove extensions you did not install. If Chrome will not stay stable after a scare, see Chrome crashing. Resetting the browser is reasonable after scareware; installing a third-party "adware cleaner" from an ad is how people get a second infection.
What you might have installed
Settings → Apps: uninstall anything added at the time of the scare (fake "Driver Updater," "Antivirus Pro," remote-support tools you did not choose). Then scan again. If Remote Desktop or Quick Assist was used by a stranger, treat accounts as compromised.
Is this the real Windows Security app?
Choose an answer. The next question appears below, no account or download required.
It is a website. End the browser in Task Manager. Do not call. Revoke notification permission. Scan with the real Windows Security app.
That can be a real detection. Follow the app's actions. It still will not ask you to call a support line or buy a gift card.
Disconnect from the network. Change passwords from another device. Uninstall remote tools they added. Consider a repair shop or a Windows reset after backup, the scare page was the lure, not the whole story.
How to know the problem is fixed
Browsers open without the scare page, notifications from unknown sites are gone, and a Windows Security scan you started from Start completes without a phone number on the screen. Restart once.
If the problem continues
If new popups appear without a browser, you may have real malware. Stay with Windows Security and official Microsoft documentation for offline scans. Avoid "one-click cleaners." If you cannot trust the PC for banking, use another device and plan a reset after copying files you trust.
When this may be hardware failure
Scare pages are not a failed hard drive. Do not buy a new PC because a website played a siren. Hardware replacement is unrelated unless a technician finds a separate disk problem.
Common mistakes to avoid
- Calling the number on the page.
- Installing the page's "security download."
- Giving a stranger Quick Assist, AnyDesk, or TeamViewer because they said they were Microsoft.
- Paying in gift cards.
Frequently asked questions
How do I know a Windows Security notification in the corner is real?
Real ones come from the Windows Security app and usually match what you see if you open that app from Start. They do not occupy the whole screen with a call script. When unsure, open Windows Security yourself and look at Protection history.
Should I change my Microsoft password?
Yes if you typed it into the fake page or told it to a caller. Use a different device if this PC might still be watched. Enable additional verification on the account when Microsoft offers it.
Written by Practical PC editorial team. We write practical Windows and PC troubleshooting guides for home users, students, and office workers. Guides are researched from official documentation and widely observed support patterns, then reviewed for safety and plain language. We do not invent lab tests, certifications, or first-hand repair experience we do not have.