Keep your cool, arm yourself with the right knowledge, and other tips for staying unshaken by fraudsters’ scare tactics
We live in fast-paced and often worrying times, and fraudsters are primed to take advantage. Fear can be a powerful weapon and scammers know how to instill it in people and coerce them into taking specific and hasty actions. In cyberspace, one common way of doing so is via something called scareware.
Scareware is a classic bluff that trades on our anxieties about cybersecurity problems that might affect our devices and data. The scheme typically dupes victims into thinking they fell victim to what is popularly known as a “computer virus” (but is better called “malware”, anyway). The goal is to lead us down a path where those fears are ultimately realized. Fortunately, calm heads and forewarning are a potent defense.
Has your computer or device screen ever been bombarded with pop-ups warning you about a malware compromise? Then you’ve probably encountered scareware. At its heart, it’s a scam where the victim is persuaded into believing their machine is infested with malware, and tricked into either paying for “AV software” they don’t need, handing over their personal/financial details, and/or installing real malware.
Scareware can be delivered several ways:
On other occasions, the tech support scammers might call out of the blue with a similar lie. These scams have been going for over a decade, and in 2023 were the third highest-grossing cybercrime type – netting fraudsters over $924 million, according to the FBI.
Scareware works by using classic social engineering techniques of the sort we often observe in phishing messages. They try to rush the victim into making a decision they’ll regret by giving them no time to think. The warning is palpable and intended to create a sense of urgency: eg, “Take action NOW or your files and photos could be corrupted FOREVER.”
The scammers will enhance this urgency by showing flashing red images, text in caps and possibly even by showing fictitious screenshots of the supposed infected files. They might also display a progress bar of the machine being scanned.
Finally, social engineering relies on persuading the victim that the message itself comes from a legitimate source. So the fraudsters will do their best to mimic the branding and names of legitimate security vendors, using names such as “DriveCleaner,” “Antivirus360,” “PC Protector” and “Mac Defender.”
At best, you might spend money on useless bloatware. You don’t get anything in return but at least that’s where the scam ends. At worst, the bad guys also harvest your personal and financial details to use in follow-on identity fraud. Or, by clicking through on the link or ad, you unwittingly install malware designed to steal your information or lock your computer with ransomware—in which case you’ll be forced to pay a charge in order to have it unlocked (which may or may not work).
The good news is that it isn’t hard to stay safe from scareware. Here are some best practices to bear in mind once you spot an “alert”:
If your computer or mobile device does get compromised with scareware, removing it shouldn’t be too much of a challenge. Remember, it’s not real malware. Simply run your legitimate security tool to scan for it manually, and follow the prompts for removal.
Failing that, you could look for the scareware manually. On Windows 10: Search for “add or remove programs” and uninstall from the list that comes up. On Macs, find the scareware program in the Applications category of the Finder window. Right-click and drag it to the Trash, then empty Trash. You should also change the passwords to any email and financial services accounts. Stay calm, and don’t be scared.
