How to tell if a virus notification is real or fake?
The short answer
If the virus warning appeared in your web browser or looks urgent with flashing text and a phone number to call, it’s almost certainly fake.
How to spot a fake virus notification
Fake virus alerts (sometimes called “scareware”) are designed to panic you into clicking something or calling a scam number. Here are the biggest red flags:
- It appeared in your browser — real antivirus software never warns you through a website
- It asks you to call a phone number — legitimate security tools don’t do this
- It uses urgent, scary language like “Your computer will be destroyed” or “Act now!”
- It asks you to download something to “fix” the problem
- It has spelling mistakes or looks poorly designed
- You can’t close it easily — it may spawn pop-ups or go fullscreen to trap you
What real virus notifications look like
Genuine virus alerts come from software already installed on your device:
- Windows Defender shows a small notification in the bottom-right corner through the Windows Security app
- Mac shows alerts through built-in system notifications, not Safari
- Android and iPhone show alerts through the system notification shade, not through a browser tab
- Antivirus software you installed (like Norton or Malwarebytes) will alert you from its own app window
The key difference: real alerts come from apps on your device, not from websites.
What to do if you see a suspicious alert
- Don’t click anything on the alert, especially not “Scan now” or “Fix” buttons
- Close the browser tab or force-quit your browser if it won’t close normally
- Don’t call any phone numbers listed in the alert
- Run a scan with your actual antivirus software to check for real threats
- Clear your browser cache to stop the fake alert from reappearing
When should you worry?
Take a virus notification seriously if it comes from your actual antivirus software (not your browser). If Windows Defender, your Mac’s built-in protection, or antivirus software you installed is flagging something, follow its instructions to quarantine or remove the threat.
If you already clicked on a fake alert or downloaded something from it, run a full scan with trusted antivirus software immediately and change any passwords you may have entered.