The warning fills the screen. The cursor disappears. The keys that normally close a window stop working, and the browser goes slow and heavy, like a machine with something wrong inside it. Nothing is wrong inside it. The message is a fake, and so is the phone number, and the phone number is the entire point of the exercise.
Researchers at the security firm Netskope say they recently found Google ads delivering this tech-support scam against both Windows and Mac computers, as Ars Technica reported. The ads surfaced across the web: on high-traffic maps, weather, real-estate, document-hosting, and sports sites. In fourteen days, from August 31 to September 14, Netskope observed users at 619 customer organizations click on them. None of those users were scammed, because Netskope’s own protections blocked the content before it could do its work.
The locker fills the screen, hides the cursor, swallows the usual exit keys, and lags the browser, all to manufacture the sense of a broken machine and pressure the person into calling the number on the screen.
That is Netskope’s description of the tradecraft, and it is worth reading carefully, because every element is aimed at a sensation rather than an outcome. Nothing on the computer is actually locked, the researchers wrote, but in the moment it is convincing enough to push people toward the scam. The visitors who did call the number encountered the rest of the operation: an urgent voice, a bogus call center, and requests to pay hefty fees, to grant remote access to the machine, or to hand over personal information.
The scale of the thing is measurable only in the part that was visible. Roughly 62 percent of the 619 organizations were based in the United States; Japan was second, Australia third. Netskope tracked more than 250 separate Google Ads campaign IDs across at least 284 legitimate publisher sites, and it notes that its visibility covers a tiny sliver of internet activity. The number of people who actually saw a fake warning, and the number who called the number, are figures the data cannot return, except to say they are larger.
What about Uncle Louie
Ars Technica’s report turns, at this point, to the audience, and it is a turn worth making. By now, the piece observes, many people, including a fair number of its own readers, ridicule and shame those who fall for such scams. The criticism fails to account for a sizable portion of internet users who have little or no understanding of how computers and the internet work; who need to get things done quickly; who find the web harder to move through every year. Combine those things, and the ridicule dissolves into demography.
There is little doubt, the report adds, that some of the critics have close friends and family among those who simply do not know enough to be wary. They are the people on the other end of the phone line the next time a screen freezes and tells them, in confident type, that they are infected. The machine is fine. The person it is after is the one holding it.