iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A frightening ransomware warning may be a fake webpage or pop-up, not proof that your files are encrypted. Don’t call a number on the screen, pay, click its links, or install remote-access software. First close the warning without interacting with it, then check whether your files open and whether there are other signs of encryption.
What fake ransomware looks like
Fake ransomware is often scareware: a webpage or pop-up designed to imitate a system or security warning and pressure you into taking action. It may fill the screen, play loud sounds, display simulated system messages, or make the mouse or keyboard seem locked. Microsoft describes these tactics as ways to trap people in alarming warnings and fake tech-support prompts: Microsoft’s guide to tech-support scams.
A warning that tells you to call a phone number is especially suspicious. The FBI notes that scareware may display reputable-looking icons that do not lead anywhere when clicked, resist the Close button, or use generic product names such as “Virus Shield,” “Antivirus,” or “VirusRemover.” These are clues, not proof on their own: FBI guidance on scareware.
Recommended Free Tools
How to check whether files are actually encrypted
Ransomware is malware that prevents access to files, systems, or networks and demands payment for their return, according to the FBI: FBI ransomware guidance. Microsoft says an infection often becomes apparent through a demand for money after files have been encrypted or access has been blocked: Microsoft guidance on ransomware and device recovery.
#1 Best Overall
A ransom demand alone does not confirm encryption. Check for evidence independently, without clicking buttons or links in the warning:
- Try opening a few ordinary files you know should be available. Note whether they open normally or produce errors.
- Look for filenames or extensions that have changed, and for ransom notes in more than one folder.
- Consider whether access is affected on shared or networked storage, not just on the device showing the warning.
- Notice whether the only sign is a browser page with alarming text, sound, or a phone number. A browser-only warning is consistent with scareware, though it does not rule out a separate infection.
Microsoft explains that fake tech-support pages may imitate system alerts and use full-screen messages, sounds, or fake phone numbers; those tactics do not establish that files have been encrypted: Microsoft’s scam-warning signs.
Quick Recap
What to do when the warning appears
- Do not engage with the warning. Don’t call its number, click its links or buttons, pay, or install software it recommends. Remote-access scammers may install malware, including ransomware, Microsoft warns: Microsoft tech-support scam guidance.
- If it is confined to a browser, close it using normal system controls. Use the operating system’s usual way to close the browser or tab rather than the page’s own buttons. If the page appears to resist closing, avoid calling its number or granting access.
- Scan with legitimate, updated security software. Use a trusted anti-malware tool and run a full scan. The FBI recommends keeping security software updated and scanning regularly: FBI scareware guidance.
- If files are inaccessible or appear encrypted, limit connections. Where practical, disconnect the affected device from networks and attached storage to reduce the risk of further spread. Preserve the warning, ransom note, and other indicators; seek qualified incident-response help rather than following instructions from the attacker.
- Report suspected ransomware. The FBI advises reporting it to the FBI or the Internet Crime Complaint Center (IC3). The FBI does not support paying ransom because payment does not guarantee that you will recover your files: FBI ransomware guidance. Organizations can follow CISA’s StopRansomware response and recovery checklist.
Quick comparison: scareware or possible ransomware?
| What you observe | What it suggests | What to verify |
|---|---|---|
| A full-screen browser warning, loud audio, fake security language, or a support phone number | Scareware or a tech-support scam is plausible; the warning itself does not prove file encryption. | Close the browser using normal system controls, then check file access and scan with updated security software. |
| Files fail to open, filenames or extensions have changed, or ransom notes appear in multiple folders | There may be genuine file encryption or access loss. | Preserve the evidence, limit network and attached-storage connections where practical, and seek qualified help. |
| Shared or networked storage is also inaccessible | The impact may extend beyond the device showing the warning. | Notify the appropriate IT or incident-response team promptly; organizations can use CISA’s response and recovery checklist. |
| The warning asks you to install remote-control software or let a caller take control | This is a major tech-support scam indicator, not a safe way to verify the alert. | Do not grant access. Use trusted security software and independently obtained support instead. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
