Fake Virus Alert? How to Close a Tech Support Scam Screen

Hello! This is Shemihaza, your Sentinel.

You were browsing the web when the screen filled with a virus warning, an alarm started blaring, and a message told you to call a support number right now. If that is happening as you read this, take a breath first.

That warning is almost certainly fake, and your PC is not infected. And as long as you do not call the number on the screen, no harm is done. This is what Japan's IPA (Information-technology Promotion Agency) states officially. All you need to do is close the window.

The scheme is called a tech support scam. IPA's Information Security Support Desk received 1,428 reports about fake virus warnings between April and June 2026 alone — 37.3% of all reports it handled, the single largest category, and about 23.7% more than the previous quarter. Reports had dipped from 912 in April-June 2025 to 647 that summer, then climbed for three consecutive quarters: 789, then 1,154, then 1,428. This is not a rare situation, and it is not something that happens only to careless people.

How the scam actually takes your money

What makes this scam dangerous is not damage to your computer. It is that you place the call and you make the payment yourself. Here is the sequence IPA documents, in four stages.

• ▸1. A booby-trapped ad triggers the fake warning: Scam groups buy ads designed to look like a "next page" button, or like an ordinary banner. IPA notes that a trap ad can even appear at the very top of search results when you search for a well-known shopping site by name. Landing on one of these is not a sign that you did something wrong.
• ▸2. Full screen and loud audio push you to call: If you click anything in a panic, the warning expands to full screen and the real close button disappears. The "X" you can see on the page is a fake image and does nothing when clicked. A voice repeats that you must call support immediately. All of it is engineered to stop you from thinking calmly. Since around August 2023 the displayed numbers have started with 0101, which routes to North America, so calling may also incur international call charges.
• ▸3. The "Microsoft support engineer" gets remote control: The operator who answers claims to work for Microsoft support and walks you through key presses such as Windows key + R to install remote access software. The tools abused are ordinary, legitimate products — AnyDesk, LogMeIn Rescue, TeamViewer, UltraViewer. Once connected, they open various screens and invent problems to show you.
• ▸4. A fake support plan extracts payment: They offer a "5-year" or "10-year" protection plan and ask for roughly tens of thousands of yen. Payment is typically demanded as Google Play or Apple gift cards bought at a convenience store, with you reading the codes aloud. IPA has handled cases where victims were sent back to the store repeatedly and lost more than one million yen, and one where a victim was made to open online banking during the remote session and an extra zero was added to the transfer amount, costing 1.98 million yen.

If the screen is on your display right now: how to close it

If you have not called anyone, closing the window is the entire fix. Your PC keeps working normally. Turn the volume down first so the alarm stops rattling you, then use one of the two methods IPA publishes.

• ▸Method 1: Press and hold the ESC key for about three seconds. Full-screen mode is released and the real close button appears at the top right of the window. Click it. If nothing appears, click once inside the warning area and hold ESC again.
• ▸Method 2: If that still does not work, press Ctrl, Alt and Delete together and choose Restart from the menu that appears. Note that restarting can lose unsaved work, so try Method 1 first.
• ▸On a tablet: Long-press anywhere on the full-screen page and an X mark appears near the top center. It does the same job as holding ESC.
• ▸If warnings keep popping up from the bottom-right corner: a site still holds browser notification permission. Remove that site's notification permission in your browser settings.

If you would like to practice before it happens, IPA hosts an official simulator that safely reproduces a fake warning screen. It is built by IPA, not a real scam page, so it is safe to try — a good thing to run once alongside a family member who is less comfortable with computers.

If you already called or granted remote access

Even then, working through it step by step is enough. These are IPA's recommended responses.

• ▸You only spoke on the phone and installed nothing: your PC is considered unaffected. Close the fake warning and clear your browser history to be safe.
• ▸You installed remote access software: uninstall it, then run Windows System Restore, which is what IPA recommends. Some remote tools never appear in the installed apps list, so if you cannot find it, run System Restore on its own. If System Restore will not run, a full reset is recommended.
• ▸The screen is moving on its own while you are not touching it: the session is live. Disconnect from the network immediately to cut the remote connection.
• ▸You were made to open online banking: if no transfer went through, change your password, check for transactions you do not recognise, and talk to your bank. If money was sent, contact the receiving bank, your own bank and the police immediately.
• ▸You read out gift card codes: keep the convenience store receipt and report it to a consumer affairs centre and the police.

What you can do today

• ✓Treat any full-screen warning that shows a phone number as fake. Real security software never asks you to phone someone.
• ✓Never call the number displayed in the warning. No call means no loss.
• ✓Never download or install remote access software because a stranger on the phone asked you to.
• ✓If anyone asks you to pay for support with convenience store gift cards, hang up. Legitimate support never collects payment that way.
• ✓On a work or school computer, contact your administrator instead of deciding by yourself.
• ✓Tell less tech-confident relatives two things in advance: this screen does not mean infection, and the number on it must never be called.

Where to get help

Whether you paid, granted remote access or signed a contract, do not carry it alone. There is nothing embarrassing about it — IPA's desk receives hundreds of these reports every month. The two hotlines below are services within Japan.

Police consultation line: #9110 (a nationwide number. The National Police Agency points to it, alongside contacting your nearest police station, for non-emergency consultations about everyday safety. Per NPA documentation it is staffed weekdays 08:30-17:15, varying by prefectural police force; outside those hours it is handled by duty staff or a voice guide, except in the forces that run it around the clock. For something happening right now, call 110)

Consumer Hotline: 188 (no area code; connects you to your nearest consumer affairs centre. This is the number for cancelling a support contract you were talked into)

Outside Japan, contact your national consumer protection body and your local police. The links below are the official sources this article is based on; the IPA pages are in Japanese.

Today's spot-the-scam quiz