A fake BSOD should be treated as a scam until proven otherwise. A real Windows Blue Screen of Death does not ask for payment, show a support phone number, play a recorded warning, or demand remote access. If a screen says the computer is “locked” and urges a call to “Microsoft support,” the safest move is to disconnect from the internet, close the browser or shut down the PC, and scan the system before using passwords or banking sites.
TLDR: Fake blue screen scams copy the look of a Windows crash to scare users into calling criminals. In a common case, a user browsing a recipe site sees a full-screen “Windows has been blocked” message with a phone number; within minutes, the scammer asks for remote access and a “repair fee.” Support scam losses can reach hundreds of dollars per victim, and the bigger risk is stolen passwords or installed remote-control software. The user should not call, should not pay, and should clean the PC from a calm, step-by-step checklist.
How fake BSOD scams work
A fake BSOD is usually not a true Windows crash. It is often a web page, pop-up, browser notification, malicious ad, or unwanted program that imitates the blue error screen. The goal is simple: panic the user. Once fear takes over, the victim is more likely to call a fake support number or click a “fix now” button.
The scam often starts with a bad ad on an otherwise normal site. It may also come from a shady download, pirated software, fake driver updater, or browser extension. The page switches to full-screen mode and displays alarming text such as “Your PC has been locked,” “Trojan detected,” or “Do not restart.” Some pages play a loud voice message. Some disable right-clicking or make the browser difficult to close. The annoying part is that a simple browser trick can make a normal computer feel completely trapped.
If the victim calls the number, the scammer pretends to be from Microsoft, Windows support, an antivirus company, or an internet provider. The person on the phone may sound polite and technical. Then the script begins. The scammer asks the user to install remote-access software, open Event Viewer, or run commands that look scary but prove nothing.
Event Viewer is a favorite prop. Every Windows PC has warnings and errors in logs. That does not mean the machine is infected. Scammers point to normal entries and claim they are “hackers,” “foreign connections,” or “expired security certificates.” After that, they ask for money, gift cards, bank transfers, crypto, or card details. In worse cases, they steal files, save browser passwords, or leave remote-access tools behind.
Common warning signs
- A phone number appears on the blue screen. Real Windows crash screens do not provide a support hotline.
- The message says not to restart or close the page. Real system errors do not need threats.
- There is a demand for immediate payment. Microsoft does not charge users through pop-up alerts.
- The screen appears inside a browser tab. A real BSOD takes over the whole system and usually restarts the PC.
- A voice alert plays repeatedly. This is a scare tactic, not a normal Windows feature.
- The page uses poor grammar or odd wording. Many fake alerts use phrases such as “Windows Defender Security Center has blocked this PC.”
- The caller asks for remote access. Remote tools are useful in real support, but scammers abuse them constantly.
- The “technician” asks for gift cards, crypto, or a wire transfer. That is a major red flag.
What a real BSOD looks like
A real BSOD usually shows a sad face, a short message, a stop code such as CRITICAL_PROCESS_DIED or IRQL_NOT_LESS_OR_EQUAL, and a progress percentage while Windows collects error data. It may restart automatically. It does not ask the user to call anyone. It does not ask for credit card details. It does not open chat support.
A fake one often sits in the browser and refuses to go away. Pressing Esc may exit full-screen mode. Pressing Alt + F4 may close the browser. Pressing Ctrl + Shift + Esc may open Task Manager, where the browser can be ended. If those fail, a forced shutdown may be needed.
Steps to secure an affected Windows computer
- Disconnect from the internet. The user should turn off Wi-Fi or unplug Ethernet. This cuts off remote sessions and stops active web scripts.
- Do not call the number again. If a call already happened, the user should end it. No further instructions from the caller should be followed.
- Close the fake screen. The user can try Esc, Alt + F4, or Ctrl + Shift + Esc. In Task Manager, the browser process can be ended.
- Restart the PC. A restart clears many browser-based fake alerts. If the alert returns at startup, more cleanup is needed.
- Run Microsoft Defender. The user should open Windows Security, go to Virus & threat protection, and run a Full scan. A Microsoft Defender Offline scan is better if malware is suspected.
- Remove suspicious apps. In Settings > Apps, the user should uninstall unknown remote tools, fake antivirus apps, driver updaters, coupon extensions, or programs installed on the same day as the incident.
- Check browser extensions. Chrome, Edge, and Firefox extensions should be reviewed. Anything unknown or recently added should be removed.
- Reset browser notifications. Scam sites often abuse notification permissions. The user should block or remove suspicious sites from notification settings.
- Change passwords from a clean device. Email, banking, Microsoft, social media, and shopping passwords should be changed. If the scammer had remote access, this step is urgent.
- Enable multifactor authentication. MFA helps block stolen password use.
- Contact the bank if payment details were shared. Cards may need to be frozen or replaced. Unauthorized charges should be reported fast.
- Check for remote-access leftovers. AnyDesk, TeamViewer, UltraViewer, RemotePC, or similar tools should be removed unless the user knowingly needs them.
If the scammer had full remote control, the safest path may be a professional inspection or a Windows reset. Honestly, it feels like overkill until passwords, browser sessions, and saved documents are considered. A reset is not always required, but it may be the cleanest answer when the attacker installed tools or moved through personal files.
How to prevent another fake BSOD
- Keep Windows and browsers updated. Updates close security gaps that bad ads and scripts may abuse.
- Use a trusted ad blocker. Many fake BSOD pages arrive through malicious ads.
- Download software only from official sites or the Microsoft Store.
- Avoid fake “PC cleaner” and “driver booster” tools. Many create more problems than they solve.
- Teach the household one rule: no support number shown in a pop-up should be trusted.
FAQ
Is a fake BSOD always caused by malware?
No. Many fake BSODs are only browser pages or malicious ads. Still, the user should scan the computer because unwanted extensions or suspicious downloads may be involved.
Can Microsoft lock a PC and show a phone number?
No. Microsoft does not lock personal computers through browser pop-ups and does not display support numbers on crash screens.
What if the user already paid the scammer?
The user should contact the bank or card provider at once, dispute the charge if possible, and watch for follow-up scams. Scammers often call again pretending to offer a refund.
What if remote access was granted?
The internet connection should be cut, remote-access apps should be removed, passwords should be changed from another device, and a full security scan should be run. Banking and email accounts deserve the fastest attention.
Should the affected PC be reset?
A reset may be wise if remote access was granted, unknown software was installed, files were opened, or the user cannot confirm the system is clean. For a simple browser-only scare page, scans and browser cleanup may be enough.