Tech-Support Pop-Up Scam

What happened

A tech-support operator ran a scam built around deceptive browser pop-up ads. The pop-ups were designed to mimic urgent operating-system security alerts, sometimes claiming to be from Microsoft or Apple, telling consumers their computer had been infected or otherwise compromised and was now 'blocked.' The pop-ups instructed victims to call a toll-free number immediately. Consumers who called were routed to a call center in India operated by NTS Global Services, Pvt. Ltd., where representatives remotely accessed consumers' computers, ran fake diagnostic scans, falsely claimed to find viruses, spyware, or security breaches, and used high-pressure sales tactics to sell multi-year technical-support packages typically costing $99.99 to $499.99. Two parallel federal cases followed. The FTC sued the defendant company and its operator in the Northern District of California, obtaining a stipulated order for permanent injunction and monetary judgment on December 4, 2020, without an admission of liability. Separately, DOJ prosecuted the operator by criminal information for conspiracy to commit wire fraud; the DOJ page separately reports a guilty plea date that conflicts with the reported filing date, and the operator was sentenced on May 11, 2023 to 12 months and a day in prison plus three years of supervised release."

How it worked

The deception began with browser pop-ups engineered to look like genuine operating-system security warnings, leveraging Microsoft or Apple branding cues rather than appearing as obvious ads. The pop-up created fear and urgency by claiming the device was compromised and 'blocked,' then directed the user to call a number. Once on the phone, the call was routed to an India-based call center operated by NTS Global Services, Pvt. Ltd., where agents remotely accessed the consumer's computer, used fabricated scan results to reinforce the false narrative, and promoted costly multi-year support contracts. The scheme exploited older adults and people less familiar with computer security.

The lure and the tell

The lure was a browser pop-up styled as an urgent OS-level security alert (invoking Microsoft/Apple) claiming the computer was infected and blocked, with a toll-free number to call immediately. Tells that, in hindsight, marked it as fraudulent: legitimate OS or vendor security alerts do not appear as ad-style browser pop-ups demanding an immediate phone call; genuine Microsoft/Apple do not proactively cold-contact consumers via pop-up to sell remote tech support; the 'diagnostic scan' run by phone agents after remotely accessing the machine was staged/fabricated rather than a real, verifiable check of the device; and the sales pitch pressuring an immediate multi-year purchase (bypassing normal consideration time) was itself a hallmark of telemarketing-fraud tactics the FTC's Telemarketing Sales Rule targets.

Outcome

Two parallel federal actions resulted. Civil: the FTC obtained a stipulated permanent injunction and a $4.9 million monetary judgment, entered under seal on December 4, 2020, against the defendant company and its operator. Most of the judgment was suspended based on documented inability to pay, with specified asset turnover. Criminal: DOJ separately prosecuted the operator by criminal information for conspiracy to commit wire fraud. The DOJ page reports conflicting plea and filing dates, and the operator was sentenced on May 11, 2023 to 12 months and a day of imprisonment followed by three years of supervised release.

Why it matters

This case documents a pop-up-lure tech-support vishing pattern in which the victim initiates contact after seeing a fear-inducing warning. It illustrates brand impersonation, manufactured urgency, remote-access abuse, fabricated technical evidence, and high-pressure sales. It also shows the distinction between a suspended civil monetary judgment, ordered asset turnover, and a separate criminal sentence.

Defenses

Treat any browser pop-up claiming your device is infected or blocked, especially one urging an immediate phone call, as fraudulent. Close the browser or tab rather than calling the number or clicking the pop-up. Never grant remote access or make a purchase decision under manufactured time pressure from an unsolicited technical warning; contact the vendor through a known, independently verified channel instead.