Virus warning on your Mac: fake or real? How to tell

You are browsing and suddenly a big warning appears: "Your Mac is infected with 3 viruses!", with a countdown, a siren or a phone number you must call. Do not panic. In almost all cases this is a fake warning from a website, meant to scare you into buying a useless program, giving someone access to your Mac or entering your details. This article explains how to recognise a fake virus warning, how to get rid of it and what to do if you already clicked something.

Blue Apple repairs MacBooks in Amsterdam and sees these warnings regularly. With the steps below you are usually rid of it quickly.

How to recognise a fake warning

• The warning is in your browser, in a tab or pop-up, not in a macOS window.
• It includes a phone number to call, or a button to download something.
• There is urgency: a countdown, a siren, "your files will be deleted in 5 minutes".
• The Apple or antivirus logo is used, but the address in the address bar is not an Apple site.

Apple never sends such warnings in your browser, and never asks you to call a number. If in doubt, close everything and look up Apple's number yourself on the official website, never through the warning. A real support line will never ask you to install remote-access software out of the blue.

Getting rid of the warning

1. Do not click anything in the warning, not even "OK" or "Close".
2. Close the tab with Command + W.
3. If that does not work, force quit Safari with Command + Option + Esc.
4. Reopen Safari while holding Shift, so the old tabs do not come back.

Blocking pop-ups

In Safari go to Settings, Websites, Pop-up Windows. Set the default to Block and Notify. If you see "Pop-up Window Blocked", Safari stopped a pop-up; that is good. Also turn on the fraudulent website warning in Settings, Security.

The warning keeps coming back?

Then there may be adware on your Mac or in Safari. Check this:

• Safari, Settings, Extensions: remove extensions you do not recognise.
• System Settings, General, Login Items: turn off items you do not recognise.
• The Applications folder: remove programs you did not install yourself. See removing apps on your Mac.
• System Settings, Privacy and Security, Profiles (if present): remove profiles you do not recognise.

Also read Safari not working or slow and a virus scanner on a Mac: needed or not.

You already called or installed something

• Gave someone remote access? Disconnect from the internet and remove the screen-sharing program you installed.
• Paid or gave bank details? Call your bank immediately to block the payment.
• Entered passwords? Change them from another device, starting with your e-mail and your Apple Account.
• Report it to the police if you lost money.

Real macOS warnings

macOS has its own built-in protection (XProtect). If it finds something, you get a warning in a macOS window, with no phone number, offering to move the file to the Bin. Simply follow that warning.

What we do at Blue Apple in Amsterdam

We check your Mac for unwanted programs, extensions and profiles, and remove them. You hear beforehand what it costs. More on our page about MacBook repair in Amsterdam.

Frequently asked questions

Can a website infect my Mac just by showing a warning?

Almost never. The danger lies in what you do next: calling, downloading or entering details.

Should I buy a virus scanner after such a warning?

No, certainly not the scanner the warning promotes. Follow the steps above.

Why do I get these warnings?

Often through ads on less trustworthy websites, such as sites for free films or downloads.