Scareware: Definition, Identification & Prevention

Topics

Security

TL;DR

Scareware is deceptive malware that uses fear and urgency to trick users into downloading harmful software. It can take the form of fake antivirus alerts, ransomware, spyware, or phishing schemes. Protecting yourself requires cautious clicking, up-to-date antivirus tools, ad blockers, and browser hygiene — and if infected, a multi-step removal process can help restore your system.

Understanding scareware and how it works

Scareware is a form of malignant software (malware) that users are tricked or scared into downloading. Once activated, the software exposes data, deletes files, steals funds, or takes some other form of harmful action. Finding a simple scareware definition isn't easy, as plenty of different software types, each with a slightly different function, could qualify for the term.

Scareware developers are savvy. The prompts they use often look legitimate and official, and the text urges you to act fast so you don't have time to think about the harm you could cause with each click. Being cautious with your clicks is your best defense — but if you are infected, antivirus software can clean up the damage.

What Is Scareware?

You're working on your computer, and a window appears. It mentions that your computer is infected, and all your files will soon be erased. Click a button to start the scan, you're urged. It's the only way to continue.

A scareware prompt like this blends urgency, fear, and computer programming into something you just can't ignore.

Plenty of scareware examples exist, including:

Scamware. Programs like SpeedUpMyPC promise to wipe away viruses with just one click. But as experts explain, no simple click can clean your computer. Starting the scan installs malicious software instead.
Spyware. You're encouraged to download and install a file or an app. The program starts collecting your data, your clicks, and your logins. Some spyware prompts come via email, but other threats appear in app stores. Just as scareware can infect your computer, some versions can take over your phone.
Ransomware. You tap a button to download some software. Then a screen appears, locking you out of your own system. You're told that access to your files can't be restored until you pay.
Spear phishing. An individual or groups of individuals inside an organization or business gets an email encouraging some kind of action. The action seems legitimate, but instead convinces them to surrender sensitive data or financial information. An entire enterprise information technology (IT) system could fall in response to an attack like this.

In general, if you're scared or tricked into downloading software that will do you harm, you're dealing with scareware.

How does scareware gain access to your information?

Chances are, you click on hundreds of buttons on your computer screen every day. You tap "Next" buttons to see new search results, you hit "Submit" to turn in forms, and you click an "X" to close a window. Each movement seems harmless. But when you're dealing with scareware, each click starts a serious chain of events.

The two most common attack flows — scareware popup ads and pseudo-antivirus programs — follow distinct but equally deceptive step-by-step patterns, as shown below:

Scareware Popup Ads	Pseudo-Antivirus Program
Attention-getting popup: You're shown a big window or modal that blocks all of the work you were doing. It seems that you have to act before you can do anything else on your computer.	Enabled buttons: Anything you click within this email could be a hot button that triggers a download.
Threatening text: You're told that you'll lose access to all files. Or you're told that your search history (including anything unsavory) or personal information will be shared.	Legitimate-seeming websites: A button click brings you to a web destination, the site looks slick and professional.
Multiple buttons: You're told to click a button to make it all stop. Even the button you might use to close the popup is a potential source of entry.	Payment options: You enter your credit card information to start the transaction. The hackers now have your financial information.
Clicks happen: You click a button which purports to do one thing, but instead it triggers a download.	Software download: Complete the transaction, and you're encouraged to download the software.

Or consider a pseudo-antivirus program. You get an email that tells you that your computer is vulnerable to a virus, and by paying one low fee, you can fix the problem.

Once the software sits within your system, it can morph and modify to avoid your antivirus software. It may also replicate, so attempts to eliminate it might leave a copy behind.

How do you remove scareware and recover your system?

Hackers and developers want their software to stay on your computer for weeks, months, or even years. They work hard to ensure that you don't remove the programs from your computer. But with a little hard work, you can do so.

Follow this multi-step process:

Update your antivirus software. If you have a program installed on your computer, ensure that you're using the current version. Updates include data about new threats, which might include the one sitting on your computer.
Workplace computers often have antivirus programs installed. If you can't find yours, talk with your IT team.
Run an antivirus scan. Start the program, and encourage a deep cleanse. Skip over versions that run quickly in the background. Dig as deep as the software will allow.
Windows users: Try Windows Defender Antivirus. This software comes bundled with Windows 10, and it could pick up threats your commercial virus programs pass by. It takes about 15 minutes to run a complete scan with this program.
Restart your computer. With two scans completed, ideally with two types of software, you're ready to test your system. If you see even more windows appearing in front of your computer screen enticing more downloads, you're likely still infected.
Ask for help. If all of your do-it-yourself (DIY) work doesn't clean your computer, an IT professional could be an important ally. Ask this person to walk through your entire system to find and eliminate the scareware.

Downloading scareware takes seconds. Recovery takes much longer. But plenty of people recover from attacks just like this.

What are some real-world examples of scareware attacks?

If you've dealt with nasty virus downloads, you're certainly not alone. These attacks are common, and plenty of people and companies have been caught in the web of these scams.

Example	Year	Key Detail/Outcome
Hackers adapting to browser rules	Ongoing	Hackers are adept at working around rules imposed by browsers. They change techniques often. For example, some hackers now use a fake alert to warn users of an imaginary threat, and these users are encouraged to download malware directly from an app store, not just by clicking a button.
A Tennessee insurance agent's costly encounter	2020	An insurance agent in Tennessee lost more than $2,000 from a scareware scam that began with his computer and concluded with a phone call. He paid the hackers directly to "fix" a problem with his computer, and then paid a second sum when the hackers triggered a malware relapse.
FTC enforcement actions	2011–2012	The Federal Trade Commission (FTC) is aware of the threats caused by scareware. In 2012, FTC lawyers secured a $163 million judgment against a scareware manufacturer. In 2011, an FTC settlement with a scareware company resulted in checks paid to more than 300,000 victims.

How can you prevent scareware and malware attacks?

IT experts can clean up your computer, and lawyers and the FTC can help you fight back after a scareware issue. But your best option is to avoid these issues in the first place.

To keep scareware far away:

Use trusted antivirus scanners. Ensure that your computer is protected and download updates for accurate threat scans. Remain vigilant, and allow for frequent scans. You may not know you're infected.
Download browser updates. Companies like Firefox release new versions regularly, and those update files could include virus protections. Make sure you're using the current version.
Set up adblocking. Some scareware developers rely on popups that sit in front of browser windows. Changing your settings to block popups and ads could keep those threats from deploying on your computer. About 40 percent of computer users didn't know that antivirus scanners aren't ad blockers. If you're one of them, this tip could be incredibly useful for you.
Close your browser. Scareware is tricky, and sometimes, closing a window means downloading software. Closing your browser altogether, even if it means losing a bit of work, is the safest option.

If you're unsure about a site or a button, do a little digging before you click.

How can you evaluate a suspicious link before you click?

Before clicking any suspicious link, use these three techniques to assess whether it is safe.

Hovering. Placing your cursor over a button should tell you where you're headed after a click. If you see a destination you don't recognize, be careful.
Typing. If you're sent a scareware email from a company you know and trust (like your bank), head to the company website via typing the address in your browser bar. Or call customer service directly. You may find that all the words of warning in the email are fictitious.
Thinking. If a threat hits close to home, stop before you react. For example, if a hacker threatens to expose your browser history, think about how the person would get that data. Is it legitimate? Or is the person preying on well-known fears, such as unsavory website visits?

No matter how much a scareware developer wants to harm you, it's not possible unless you play along. Take steps to protect yourself, and ensure that you're clicking with care. Don't let anyone pressure you into making a mistake.

We Can Help

Okta provides an end-to-end suite for responding to cyber threats, including malicious programs like scareware. Discover how Okta can help keep your infrastructure safe.

Frequently asked questions

What is scareware and how does it differ from other malware?

Scareware is a form of malware that tricks or scares users into downloading harmful software. Unlike generic malware, scareware relies on psychological manipulation — urgency and fear — to prompt action. It encompasses several subtypes: scamware (fake cleanup tools), spyware (data-harvesting apps), ransomware (file-locking extortion), and spear phishing (targeted deceptive emails). What unites them is that the user is deceived into initiating the infection themselves.

How does a scareware popup trick you into downloading malware?

A scareware popup typically blocks your screen with an alarming message — warning that your files will be erased or your personal data exposed. It presents buttons that appear to resolve the issue, but every click, including the one meant to close the window, can trigger a malicious download. The urgency of the message is designed to prevent you from pausing to evaluate whether the threat is real.

What steps should you take to remove scareware from your computer?

Start by updating your existing antivirus software to ensure it has the latest threat definitions, then run a deep scan. Windows users can also run Windows Defender Antivirus, which is bundled with Windows 10 and may catch threats commercial tools miss. After scanning, restart your computer to test whether the infection persists. If scareware windows continue to appear, consult an IT professional to conduct a thorough system review.

How can you tell if a suspicious email or popup is a scareware attempt?

Before clicking anything, hover your cursor over links to preview the destination URL — an unfamiliar address is a red flag. If the message appears to come from a trusted company like your bank, navigate to that company's website directly by typing the address in your browser, or call customer service to verify. Also consider whether the threat is plausible: scareware often exploits common fears (like exposed browsing history) without any real basis for having that data.

What tools can help prevent scareware infections?

Keeping trusted antivirus software updated and running frequent scans is the first line of defense. Downloading the latest browser updates (such as those from Firefox) adds another layer of protection, as these often include security patches. Setting up ad-blocking in your browser can prevent scareware popups from appearing in the first place. When in doubt, closing your browser entirely — even at the cost of losing some work — is safer than risking a malicious download.

Has the government taken action against scareware developers?

Yes. The Federal Trade Commission (FTC) has pursued legal action against scareware operators on multiple occasions. In 2012, FTC lawyers secured a $163 million judgment against a scareware manufacturer. In 2011, an FTC settlement resulted in refund checks being issued to more than 300,000 victims of a bogus scareware scam.