Fake antivirus and scareware: how to spot it and what to do

Scareware is anything designed to frighten you into acting quickly — calling a number, paying for software or installing a program — by claiming your computer is infected or at risk. Fake antivirus (also called rogue security software) is a particular version: a program or website that pretends to be antivirus but is really there to take your money, your data or control of your PC.

These scams often borrow the names and logos of real companies, including Microsoft, AVG and other well-known security brands. Knowing how they work makes them much easier to spot.

1. The most common types

Fake scan websites

A web page suddenly shows an animated "system scan" that finds dozens of viruses in seconds, often with a siren and a full-screen warning. A website can't scan your computer — the results are made up.

Fake notifications

Small pop-ups in the corner of the screen that look like antivirus alerts ("Your subscription has expired — your PC is unprotected"). These usually come from a website you once allowed to send notifications, not from any antivirus.

Rogue security programs

Software with an official-sounding name that you're tricked into installing. It "finds" problems and demands payment to fix them, and may install other malware.

Fake invoice and renewal emails

Emails claiming your antivirus subscription has automatically renewed for a large sum, with a phone number to call "to cancel". The caller then asks for remote access or bank details to process a "refund".

Tech-support calls

Someone calls claiming to be from Microsoft, your internet provider or an antivirus company, saying your computer is sending errors or is infected.

2. Warning signs

• A phone number to call — real antivirus alerts never include one.
• Urgency and fear: countdowns, sirens, "do not turn off your computer", "your files will be deleted".
• The warning appears inside a web browser, not in your installed security program.
• It names a product you don't have installed, or says your subscription expired when you never bought one.
• It asks you to install remote-access software or a "cleaner".
• It asks for payment by gift cards, cryptocurrency or wire transfer.
• The email sender's address or website address doesn't match the company's official domain.

3. What real antivirus alerts look like

Genuine alerts come from the security program actually installed on your PC — Windows Security, AVG or another product. They appear as a small notification from that program or inside its own window. You can always check by opening the program yourself from the Start menu: if it's real, the alert will be in its history (in Windows Security, look under Virus & threat protection > Protection history).

Not sure which antivirus you have? Open Windows Security > Virus & threat protection. It shows which product is currently protecting your PC.

4. How to get rid of it

A scary web page

1. Don't click anything on the page. Press Esc to leave full screen, then close the tab.
2. If the browser won't close, press Ctrl + Shift + Esc, select your browser in Task Manager and choose End task.
3. When reopening the browser, don't restore previous tabs.

Fake notifications

In Chrome, go to Settings > Privacy and security > Site settings > Notifications and remove any site you don't trust. In Edge, go to Settings > Cookies and site permissions > Notifications. A browser tool such as Guardio can also find and remove these.

A rogue program

1. Go to Settings > Apps > Installed apps, sort by install date, and uninstall anything you don't recognise that appeared around when the problem started.
2. Run a full scan with your real antivirus. In Windows Security, also try Microsoft Defender Offline scan from Scan options, which runs before Windows loads.
3. Check your browser's extensions (chrome://extensions) and remove anything unfamiliar.

5. If you already paid or gave access

• Disconnect from the internet if someone has remote access, and uninstall any remote-access program they asked you to install.
• Call your bank or card provider using the number on your card. Explain it was a tech-support or fake antivirus scam.
• Change your passwords from a different, trusted device, starting with email and banking. Turn on two-step verification.
• Run a full antivirus scan and an offline scan once you're back online.
• Report it. In India, report cyber fraud at cybercrime.gov.in or call the national helpline 1930. Elsewhere, use your national fraud-reporting service.
• Beware of "refund" calls. Scammers often call back offering to return your money. Hang up.

6. How to protect yourself

• Keep a real antivirus running — Microsoft Defender or a reputable product such as AVG.
• Only download security software from the company's official website, typed in yourself.
• Don't click Allow on notification prompts from websites you don't know.
• Turn on your browser's built-in protection (Chrome's Enhanced protection or Edge's SmartScreen).
• If an email says you've been charged, check your bank statement or log in to the company's official website directly — never use the phone number in the email.
• Talk to older relatives about these scams. A two-minute conversation prevents a lot of harm.

Frequently asked questions