Home › Fake alerts and support scams

Fake security alerts and technical support scams

A calm explanation of a format most Australians encounter eventually: a message that looks like a system warning, produced by a web page that has no ability to see your computer at all.

Reviewed by the Arcadia Group editorial team · Last reviewed 17 September 2026

The technical fact the whole format depends on

A web page runs inside a browser, and the browser deliberately keeps it there. Pages can display text, images and animations; they can play sound; they can attempt to open windows. What they cannot do is read the files on your drive, inspect your installed software, or examine your system's configuration. That boundary is a core design principle of every mainstream browser, not an optional setting.

So a page announcing that it has scanned your computer and found problems has not done that. It is showing a picture of a scan. The "progress bar" is an animation with a fixed duration, and it shows the same result to everyone who loads the page. The imitation may be very good — realistic window frames, matching fonts, a convincing operating system logo, even an approximation of your browser's own dialogue style — but the underlying claim is not technically possible.

Holding onto that single fact is more protective than any software, because it applies regardless of how convincing a particular example looks.

How the approach is usually built

These operations follow a recognisable sequence, and knowing the sequence makes the individual steps much easier to spot.

Arrival. An advertisement on a page, a mistyped address, a pop-up from a free download site, a search result, or an email. Some appear during ordinary browsing on legitimate sites via the advertising chain.
The imitation warning. A page resembling a system message, often with an alarm sound, sometimes made hard to close by repeated dialogue boxes. The impression of being stuck is deliberate and is a designed feature of the page.
The phone number. The message invariably directs you to call, because a conversation is where persuasion works. A genuine security product does not ask you to ring a number displayed inside a web page.
The call. A confident, technically fluent person explains what is wrong. Ordinary system tools — event logs, network listings, temporary folders — are presented as evidence of infection. They are normal features of every working computer.
The remote session. You are asked to install remote access software so they can help. This is the pivotal moment: from here they can see files, install software, and open banking sessions.
The payment. A fee for a repair, a support contract, or a refund that requires "verifying" your account. Payment is often requested in forms that are hard to reverse.

The National Anti-Scam Centre publishes current variants and a reporting route at scamwatch.gov.au, and the Australian Cyber Security Centre covers the same territory from a cybercrime perspective at cyber.gov.au. Both are worth reading directly rather than through summaries.

Telling a genuine message from an imitation

Characteristics that separate real security software messages from imitations. No single row is conclusive on its own; together they are reliable.
Characteristic	Genuine security software	Imitation
Where it appears	Outside the browser, as an application notification you can find again in the product's own interface.	Inside a browser tab or a pop-up window, disappearing if the browser is closed.
Tone	Factual: a file name, an action taken, an option to review.	Urgent and alarming, often with a countdown or a stated number of threats.
What it asks of you	Nothing, usually — the action has already been taken automatically.	Call a number, install a tool, or pay a fee.
Naming	Names the product you installed.	Invokes a large technology company generically, and sometimes several at once.
Closing it	Closes normally.	Resists closing, reopens itself, or takes over the full screen.
Record afterwards	Logged in the product's history, visible when you open it yourself.	No trace anywhere on the machine, because nothing happened on the machine.

What to do when one appears

Nothing has happened to your computer at this point, so there is no need to hurry. The response is short.

Do not call the number, and do not use any contact details shown on the page.
Close the tab. If dialogue boxes prevent that, close the browser entirely using your operating system's task manager or force-quit function.
When reopening the browser, decline any offer to restore the previous session, which would reload the same page.
Clear the browser cache if the page keeps returning, and check your installed extensions.
If you want reassurance, run a scan using the security software already installed — opened from your own machine, not from anything the page offered.
Report it at scamwatch.gov.au, which takes a couple of minutes and contributes to national reporting.

If the conversation went further

Plenty of capable people have been talked through these calls; the scripts are refined and professionally delivered. What matters now is the sequence, and doing it without embarrassment slowing you down.

Disconnect the computer from the internet if a remote session is open or may still be running.
Contact your bank immediately if payment details were entered or a transfer was made. Speed materially affects what can be recovered.
Change passwords from a different device — email first, then banking, then anything that shares a password. Turn on multi-factor authentication as you go.
Remove any remote access software that was installed during the call, and have the machine checked if you are not confident it is clean.
Report it. Cybercrime can be reported to the Australian Cyber Security Centre at cyber.gov.au, and scams to the National Anti-Scam Centre at scamwatch.gov.au.
If identity documents were shared, Scamwatch sets out the support services available to people whose personal information has been misused, including free national identity support.

Where personal information is involved

If an organisation you deal with has a data breach affecting your personal information, the Notifiable Data Breaches scheme requires them to notify affected individuals in defined circumstances. The Office of the Australian Information Commissioner explains the scheme and your options at oaic.gov.au. That is a different situation from the one on this page, and it is worth knowing which you are in.

Helping someone else in the household

These approaches are aimed disproportionately at people who are less confident with computers, and the most effective defence in a household is social rather than technical: agreeing in advance that nobody calls a number that appeared on a screen, and that any such message is something to mention to someone else first. A message that gets discussed before it gets acted on is a message that fails.

The eSafety Commissioner publishes plain-language resources for older Australians and for families at esafety.gov.au, including material designed for people helping a relative learn. Those are more useful here than any product, because this is a category of problem that software does not solve.

Adjacent formats worth recognising

Renewal invoice emails. A message claiming a subscription has auto-renewed for a large sum, with a number to call. Check the billing history in your own account instead — see subscriptions and renewals.
Refund reversals. A caller claims to have refunded too much and asks you to return the difference. The original "refund" is usually just a manipulated display of your own account.
Imitation download pages. Advertisements and lookalike domains offering well-known security products. Type the vendor's address yourself.
Browser notification spam. Permission granted once to a site, producing warnings that look like system alerts. Revoke it in your browser's notification settings.

The underlying principle

Every version of this format needs you to act quickly, alone, and through a channel the other party controls. Slowing down defeats all of them, and no legitimate organisation is harmed by you hanging up and contacting them yourself through details you found independently.

For the software side of the question, our guides on how antivirus software works and what your desktop already protects set out what detection software genuinely does — and, as importantly, the categories of problem it is not built to solve.