Frank was two moves from winning solitaire when his computer started screaming — and a very polite man named Kevin was standing by to make everything so much worse.
Frank Delgado, seventy-one, retired shop teacher, had a morning routine you could set a watch by. Coffee in the mug his granddaughter painted (a lopsided sun, the word GRAMPA in orange). Twenty minutes of news. Then solitaire — real solitaire, the built-in kind, none of that app-store nonsense with the coins and the gems.
He was two moves from winning. He remembers that clearly, the way people remember where they were standing when the weather turned. Two moves. A red jack on a black queen, and then—
The screen exploded.
Not literally. But that's how he'd describe it later at the coffee group, and honestly it's fair. One second: playing cards. The next: the entire screen swallowed by an official-looking blue page with a Windows-ish logo, a spinning red shield, and letters the size of hubcaps:
⚠ WINDOWS DEFENDER SECURITY CENTER ⚠
TROJAN SPYWARE ALERT — ERROR # 0x80073b01
Your computer has been LOCKED. Your banking information, passwords, and photos are being transmitted to a remote attacker.
DO NOT SHUT DOWN OR RESTART YOUR COMPUTER.
Call Microsoft Support immediately: 1-888-555-0142
And the sound. A blaring, air-raid-style alarm, over which a calm robotic woman repeated: "Important security message. Your computer has been compromised. Do not attempt to shut down your computer."
Frank jiggled the mouse. Nothing. Clicked the X. There was no X. Tapped keys. The blue screen just sat there, pulsing, shrieking, telling him his photos — the photos of Elaine, forty years of them — were being "transmitted to a remote attacker."
Here is the thing nobody had ever told Frank, and it's the whole secret of this story, so let's say it now, plainly: that screen was a web page. An ordinary web page, like a recipe blog or the weather. It had thrown itself into full-screen mode, it was playing an alarm sound on a loop, and it was lying. A website cannot scan your computer. A website cannot see your files, your photos, or your bank. It knows about as much about your hard drive as a billboard knows about your cholesterol.
But it looked real. It looked very real. And there was a phone number, and Frank was a man who believed in fixing things promptly.
He called the number.
"Thank you for calling Windows Global Support Center, this is Kevin Anderson, employee ID KV-2214, how may I secure you today?"
Kevin's voice was warm, unhurried, and absolutely swimming in call-center noise — dozens of other Kevins murmuring in the background, presumably securing dozens of other Franks.
"My computer's got some kind of alert," Frank said. "Says I'm infected. It's making a heck of a racket."
"Yes sir, do not be panic," said Kevin soothingly. "I am seeing here in our server that your computer is sending us the alert also. You are Mr. Frank, yes?"
Frank blinked. He had not given his name. (Neither had his computer — Kevin was guessing off the caller ID, a trick that works far more often than it should.) "That's right."
"Mr. Frank, I am sorry to inform, your computer has been hacked by the hackers." Kevin said the hackers the way a doctor might say the results. "But you have called the right place. I am a certified senior technician. Ten years' experience. I will personally fix. There will be no charge for the diagnostic," he added, generously, like a man waiving a fee he had just invented.
And here's what you have to understand about Kevin: he was good at this. He never rushed. He never threatened. He was patient with Frank's typing, chuckled at Frank's jokes, asked about the weather in Ohio. Scammers on the phone aren't snarling villains — they're the friendliest voice you'll talk to all week. That's the product. The friendliness is the scam.
"Now, Mr. Frank, so I can repair, I will connect my secure toolkit. Press together the Windows key and the letter R…"
Step by patient step, Kevin walked Frank through downloading a program. A real program, mind you — a legitimate remote-control tool of the kind office IT departments use, the kind with a cheerful name and a nine-digit code. Frank read Kevin the code.
And then the mouse pointer moved. By itself.
Frank physically leaned back from the desk, the way you would from a Ouija board. The cursor glided across his screen, opened menus, clicked things — all while his own hand lay flat on the mouse pad like a fish.
"Do not worry, Mr. Frank. That is only me." Kevin's chuckle came down the line, rich and reassuring. "I am inside now."
Words which, Frank would say later, really should have landed differently at the time.
What followed was theater. Dinner theater. Kevin opened something called the Event Viewer — a dusty system log that exists on every Windows computer on Earth — and filtered it to show errors and warnings. Rows and rows of yellow triangles and red circles filled the screen.
"You are seeing all these red ones, Mr. Frank? Each one of these is a hacker attack. This one — Russia. This one, I am sorry to say, is coming from the dark web."
(Every computer's Event Viewer looks like this. Yours does right now. It's a diary of tiny routine hiccups — a printer that woke up grumpy in 2023, a program that closed impolitely. It is about as sinister as a car's maintenance log. Kevin knows this. Kevin is counting on you not knowing it.)
Then, for the finale, Kevin opened a black window with white text — the command prompt, hacker-movie aesthetics built right in — and typed a command:
C:\Users\Frank> netstat -ano
Active Connections
Proto Local Address Foreign Address State PID
TCP 192.168.1.14:49712 13.107.42.16:443 ESTABLISHED 4288
TCP 192.168.1.14:49713 142.250.65.238:443 ESTABLISHED 9016
TCP 192.168.1.14:49720 151.101.1.140:443 ESTABLISHED 9016
TCP 192.168.1.14:49731 52.96.165.18:443 ESTABLISHED 7040
..."You see, Mr. Frank? ESTABLISHED. ESTABLISHED. ESTABLISHED. These are the foreign connections. The hackers are established in your computer."
Frank's stomach dropped. It looked like the inside of a missile silo.
It was, in fact, a list of his computer politely talking to Microsoft, Google, and the website hosting his crossword. Established just means "connected" — the same way your phone is "connected" to the cell tower. Kevin was showing Frank the digital equivalent of a phone bill and reading it in the voice of a war crimes tribunal.
"Okay, Mr. Frank. Here is good news and bad news. Bad news: seventeen trojans, very serious. Good news: today only, our Level-3 Network Security Firewall Protection Plan is available. Normally this is five hundred ninety-nine dollars. But for senior citizen…" — a pause, the sound of a calculator being theatrically not used — "…two hundred ninety-nine."
Frank reached for his wallet. He actually had it out of his pocket. And then Kevin, smooth as butter, went one step further:
"Actually, Mr. Frank, easiest way — let us open your online banking right now, together, while I am connected. I will place a security hold on your account so the hackers cannot touch it, and we process the protection fee at the same time. Which bank are you having?"
Frank's fingers were on the keys. He'd typed the first three letters of his bank's name. And some small, ancient, teacher-brain part of him — the part that had watched four decades of teenagers explain where their homework went — noted quietly: why does the man fixing my computer need to watch me log into my bank?
His hand hovered.
And that's when the screen door banged.
Sofia, sixteen, Frank's granddaughter, had come by to drop off his reading glasses (left at her mom's, third time this month). She got one earful of the speakerphone — "—the security hold, Mr. Frank, we must be quickly—" — and one eyeful of the cursor moving on its own, and her face did something Frank had never seen it do. It went flat and cold, like a poker player.
She held up one finger to Frank: wait. Then she leaned toward the phone, sweet as pie:
"Hi! Quick question. Where are you calling from?"
"…This is Kevin, from Windows Support. In Redmond, Washington," said Kevin, with a shade less butter than before.
"Oh nice! How's the weather out there today?"
A pause. A long pause. A pause with continents in it.
"It is… sunny?"
"Kevin," said Sofia, "it's Washington State. Sunny is not the safe guess." And she reached past her grandfather, hit Ctrl+Alt+Del, opened Task Manager, and ended the browser with the casual brutality of a teenager closing forty tabs.
And here is the moment Frank says he'll never forget — the moment the whole cathedral of it collapsed into cardboard.
The alarm stopped. The blue screen vanished. The robotic lady shut up mid-syllable. The "virus" that had "locked" his computer and was "transmitting his photos to a remote attacker" was gone, instantly and completely, because it had only ever been a browser tab. The scariest thing on his screen all morning had exactly the same powers as a pop-up ad for orthopedic sandals.
"That's it?" Frank said. "That's it? The whole virus was… I could've just closed it?"
"That's it, Grampa. It's a scary picture with a sound file. We had an assembly about it." Sofia was already unplugging the internet cable, because there was one real problem left: Kevin's remote-control program, which Frank had genuinely installed. They uninstalled it, restarted, and — from Sofia's phone, not the computer — changed his email and banking passwords. Then Frank called his bank on the number printed on the back of his card. He hadn't logged in, hadn't paid, hadn't read out a single digit. Clean. But he asked them to watch the account anyway, and the woman at the bank said, "Sir, you're the fourth one today, and you're the first one who got out before paying. Well done."
Frank sat a little straighter for the rest of the day.
Kevin, it must be reported, called back four times that afternoon. On the fourth ring, Frank answered, let Kevin get halfway through "Mr. Frank, we were disconnected—" and said, in his best shop-teacher voice, the one that once stopped a bandsaw incident at forty feet:
"Kevin. Son. It's raining in Redmond."
Click.
🚩 A web page "detected a virus." Impossible. Websites cannot scan your computer — the popup is just a scary picture with a siren sound.
🚩 A phone number in a security warning. Microsoft and Apple never, ever put a phone number in a popup — and they will never call you, either.
🚩 "DO NOT SHUT DOWN YOUR COMPUTER." The one thing the scam truly fears is you closing it — so it orders you not to.
🚩 Sirens, countdowns, robot voices. Real security software is boring and quiet. Panic is the scammer's only tool.
🚩 A stranger who needs remote control. No legitimate company cold-fixes your computer by driving your mouse.
🚩 Normal stuff presented as terrifying "proof." Event Viewer errors and netstat's ESTABLISHED lines are on every healthy computer on Earth.
🚩 The fix costs money — or a bank login. The "virus" was free. Funny how the cure never is.
🚩 It vanished when the tab closed. Real infections don't evaporate because you quit the browser. Theater does.
A quiet assist, if you want one: these fake-alarm pages mostly arrive through bad ads and sketchy links, and the free GuardDex browser extension blocks a lot of them before they ever load — its link-scanning also flags the shady pages that host them, so the "screaming screen" often simply never appears. Honest fine print: no tool catches everything, and the real save is never calling the number. The extension quietly removes a lot of this before you see it — but the green box below is what truly protects you. And no judgment if you'd rather just remember the tells above.
If your screen ever starts screaming, here's the whole playbook:
The scam isn't in your computer. It's in the phone call. Frank's machine was never infected — not for one second. The only dangerous thing that happened all morning was a friendly voice asking for the keys. A blaring popup has exactly as much power over you as a stranger on the sidewalk yelling that your shoelaces are on fire: it's only a problem if you stop, panic, and hand him your wallet so he can "check." Close the tab. Finish your coffee. Play the red jack.
Rule of thumb to hand anyone you love: "If the computer tells you to call a phone number, it's a scam — close the browser and the 'virus' disappears with it."