What is scareware?

How does scareware work?

Scareware works by using the tactic of inciting fear or anxiety in a user, manipulating them into quickly and thoughtlessly downloading a virus or paying for fraudulent or illegitimate services. Most scareware scams initiate with a pop-up window that suddenly appears as a warning, claiming that a virus has been found on your computer. Many pop-ups have a button or a link that prompts users to remove the threats or download an antivirus software. Often, the pop-up windows will continue to appear until the button or link has been clicked.

Well-executed scareware scams involve pop-ups or warnings that look legitimate, making it difficult for users to identify that they’re being scammed. Scareware often utilizes similar logos and names of genuine antivirus software programs to confuse users. They may also display screenshots of the supposedly infected files or virus that has been found on your device, graphics such as progress bars showing virus infection rates, text in all caps to signal urgency, and flashing images. Clicking on a pop-up button or scam link often drives to a website that automatically starts downloading or installing malware. The intent of scareware scams is to scare users into downloading malware or paying for fake software and exposing their personal data.

It’s important to remember that legitimate antivirus software providers will never invite you to buy or download their products via an anxiety-inducing pop-up. If a pop-up window or suspicious email warns you to act now to save your device from being infected, it’s likely a scareware scam.

Microsoft Defender

Stay safer online with one easy-to-use app<sup>1

1</sup>Microsoft 365 Personal or Family subscription required; app available as separate download

Learn more

Types of scareware scams

Scareware scams can target users in a few different ways—via malicious pop-up window, spam email, or fake tech support calls.

Pop-up window

Probably the most common type of scareware, the fake pop-up window often appears on a website. These pop-up ads look like antivirus software warnings, telling users that they have a virus or infected files on their devices. The objective of these pop-ups is to get user to click on a button that starts the download of malware onto the user’s device.

Spam email

In addition to generating pop-up windows, scareware can involve sending emails warning users to act quickly to follow a link to download an antivirus software. Scareware emails often come from email domains that may appear legitimate but are actually from span accounts.

Fake tech support calls

Spam phone calls are on the rise—and they include fraudulent callers claiming to be tech support. Fraudulent callers may warn that suspicious activity has been detected on a user’s device and ask the user to share their personal data so that the caller can investigate the problem or access a user’s account remotely.

How to tell if you’re a target of scareware

Suddenly seeing unexpected pop-ups on screen? You might be a victim of a scareware scam. Here are a few signs that you’re being targeted:

• Windows and programs show up unexpectedly. If an icon that you don’t recognize appears on your desktop or page opens unprompted in your internet browser, these may be scareware programs.
• Banners and notifications pop up on your screen. Pop-up windows with warning messages urging you to download software are a common signifier of scareware scams.
• Error messages when you try to access files or programs. Slow performance may also indicate that your computer has been infected with malware.

How to Remove Scareware From Your Device

1. Power off your device and get an expert involved. If you’ve started downloading illegitimate software or a virus onto you device, turn off your computer to stop further damage. Then get in touch with a technician who can scan your device for malicious software.
2. Turn off the internet. If your device has been infected with a virus or malware, powering off your Internet connection can keep your data from getting spread to hackers.
3. Change your password. Change the passwords to your email accounts and financial services such as online banking to keep your personal data and assets safe.