How to get rid of a fake Windows Defender security warning

Microsoft Defender Antivirus — previously named, and still often referred to as, Windows Defender — is built into Windows operating systems to provide a basic level of device security. The Windows Defender scam takes advantage of people’s trust in Windows system alerts, using fake security warnings to trick vulnerable users.

Help protect yourself against falling victim to a fake Windows Defender security warning by learning how to spot one and how to get rid of the warning message from both your browser and device.

What is the Windows Defender security warning?

The Windows Defender security warning is a fake alert that pops up on your browser, typically claiming that your computer is infected or your personal information is at risk. It’s a type of tech support scam designed to scare you into clicking a malicious link or contacting a fraudulent ‘support center’.

However, if you click a link on the fake notification, you could end up with ransomware or another type of malware that compromises your computer. And if you phone the fake support desk, a scammer may try to trick you into giving up personal data or card details, leaving you vulnerable to identity theft or financial fraud.

More specifically, the fake Windows Defender security warning is a type of tech support scam phishing attack. Phishing is one of the most common types of cybersecurity threats, in Australia, Scamwatch received around 98,000 reports about phishing scams throughout 2024.

How to distinguish a real Windows Defender warning from a fake one

If Microsoft Defender detects a potential threat, you may receive a legitimate notification. A real Windows Defender warning will:

• Appear in the Microsoft Defender app or as a notification in the taskbar, not in a browser window.
• Prompt you to review the threat in Microsoft Defender, rather than clicking a suspicious link to a webpage.
• Never include a phone number to call.

A fake warning will often:

• Pop-up as a new window or overlay in your web browser.
• Contain urgent language to scare you into acting.
• Include a phone number for a fake support line or a malicious link (both could look convincing).
• Use Microsoft Windows branding to try and look legitimate.

Since a fake Windows Defender pop-up can look convincing, always err on the side of caution if you’re unsure. You can use Norton Genie, a free scam detector tool, to analyse the message and discover if it’s a potential fake in seconds. Alternatively, check for warnings in the legitimate Microsoft Defender app on your computer or contact Microsoft directly on an official channel. Just don’t interact with the warning message, click any links on the Windows Defender security notification, or phone any numbers listed on the pop-up.

Why am I getting the fake Windows Defender notification?

Like other scareware, you’re probably seeing the fake Windows Defender warning because you accidentally clicked a scam link, visited a malicious website, or have adware on your computer. Often, closing the window doesn’t fix the issue, and the pop-up will keep appearing until you remove the malware.

How do I get rid of a fake Windows Defender security warning from my browser?

The Windows Defender security warning scam is usually seated in a browser, so start by closing your browser entirely to get rid of the unwanted pop-up. Most important, don’t click anything in the message, and never contact a phone number or email listed in it. Instead, follow these steps:

1. Close the browser tab and reopen it. If it’s unresponsive, force close and reopen the browser.
2. Reset your browser settings, which also clears browser data.
3. Check for and remove unknown browser extensions.
4. Run a virus scan on your device to check for malware that could reinfect your browser.

Different browsers have slight variations in the exact steps to follow. Below, you’ll find steps for Chrome, Microsoft Edge, and Firefox.

Chrome

How to get rid of a Windows Defender security warning scam from the Google Chrome browser:

1. Click the X at the top of the Chrome tab to close it. If it’s unresponsive, force it to close by opening Task Manager (Ctrl+Shift+Esc), selecting Chrome, and clicking End Task.

2. Reset Chrome settings by clicking the three dots in the top right > Settings > Reset settings > Reset settings to their original defaults > Reset settings. 

3. Click the puzzle icon in the top right, then Manage Extensions. Look for any extensions you don’t recognise and click Remove.

4. Run an antivirus scan to find and remove any malware.

Microsoft Edge

How to get rid of a Windows Defender security warning scam from Microsoft Edge Browser:

1. Click the X at the top of the Edge tab to close it. If it’s unresponsive, force it to close by opening Task Manager (Ctrl+Shift+Esc), selecting Edge, and clicking End Task.

2. Reset Edge settings by clicking the three dots in the top right > Settings > Reset settings > Restore settings to their default values > Reset. 

3. Click the puzzle icon in the top right, then Manage Extensions. Look for any extensions you don’t recognise and click Remove.

4. Use a malware scanner tool to find and remove any malware.

Firefox

How to get rid of a Windows Defender security warning scam from Mozilla Firefox browser:

1. Click the X at the top of the Edge tab to close it. If it’s unresponsive, force it to close by opening Task Manager (Ctrl+Shift+Esc), selecting Firefox, and clicking End Task.

2. Reset Firefox settings by clicking the three lines in the top right > Help > More troubleshooting information > Refresh Firefox > Refresh Firefox. Refreshing Firefox will remove all your extensions — if you don’t want this to happen, you can just clear cookies and site data instead.

3. To clear cookies and site data, click the three lines > Settings > Privacy & Security > Clear Data (next to Cookies and Site Data) > check all the boxes, then click Clear > Clear Now. You then need to remove any extensions you don’t recognise: Click the puzzle icon in the top right, then Manage Extensions, and click Remove next to any unknown extensions.

4. Use a virus scanner and removal tool to be sure you have no malware.

How to get rid of a Windows Defender security warning from your computer

A fake Windows Defender security warning may not originate from your browser but could instead be a symptom of malware or a virus on your computer. To remove it, you can try uninstalling any apps you don’t recognise and running a malware scan.

Here are steps you can take to try to remove the cause of a Windows Defender scam from your computer:

1. To search for and remove apps you don’t recognise, go to Settings > Apps > Apps & features > click an app (or the three dots next to it on Windows 11) > Uninstall.
2. Run a malware scan using your preferred antivirus software. On Norton 360 Deluxe, it’s as simple as opening the app and hitting Run Smart Scan.

If Norton 360 Deluxe finds malware or a virus through its scan, it’ll provide recommendations on what steps to take next to remove the threat and protect your computer.

How to protect your devices from online scams and scareware

With so many cybersecurity threats and online scams out there, it’s practically inevitable that you’ll encounter one from time to time. Educating yourself about good browsing habits and practising good digital hygiene is key.

Following cybersecurity best practices can help prevent you from falling for attacks like the fake Windows Defender security warning. Here are some tips you can use to stay safer online:

• Keep your system and apps up to date: Installing the latest software updates regularly can help you stay on top of any potential vulnerabilities. Software updates often include patches to known vulnerabilities, so whenever an update is available, install it to help avoid leaving your system and software open to known threats.
• Always think before clicking links or download files: Take stock of whether a message, program, or website looks legitimate. Are there any suspicious-looking errors in the text or images? Are scare tactics being used to trick you into taking action? Whenever you’re in doubt, it’s best not to click.
• Only download apps from a legitimate app store or website: Apps available through legitimate marketplaces like the Microsoft Store, Google Play, Apple’s App Store, or directly from the developer’s website are typically vetted for security. This minimises the chance that they’ll contain malicious code or viruses.
• Use a VPN, especially when using public Wi-Fi: A VPN encrypts your web session to protect your connection from potential hackers. This is particularly important when you’re on public wireless networks, where you’re not in control of who has access.
• Stay up to date with the latest scams: Keeping yourself familiar with the latest internet scams, malware attack vectors, and other online threats can help you protect yourself online. Learn where they appear, how to recognise them, and what you can do to avoid them.
• Use a reliable antivirus program: A strong, tested antivirus program like Norton 360 Deluxe can help protect you from malware and malicious links and websites. Norton 360 Deluxe also provides a variety of helpful privacy tools and other useful features, including a VPN and Parental Control settings.

Defend your devices with Norton

Even if you’re as careful as possible online, new, sophisticated, and convincing threats are always emerging. Norton 360 Deluxe offers powerful protection against the evolving landscape of cybersecurity threats, with coverage for up to five devices including computers, phones, and tablets. With its industry-leading threat-detection engine, Norton will help keep you safer from hackers, malware, and other online threats like fake security pop-up notifications. Get real-time protection today.

FAQs

Is the Windows Defender Security Center warning legitimate?

Windows Defender security warnings that show pop-ups or notifications in your browser are not legitimate. If you have Microsoft Defender installed, you may get periodic alerts. But they’ll only be displayed from within the Windows Defender app itself or in your Windows taskbar.

Are there fake security alerts?

Yes, there are fake security alerts. Most of these are tech support scams in the form of scareware. The main goal of these internet scams is to scare you into downloading or purchasing a fake antivirus or support service. Tactics usually include using urgent language, flashy warnings, and persistent pop-ups. If you see this kind of threat, close your browser immediately and take steps to remove any potential malware or reverse unwanted browser changes.

Am I safe with just Windows Defender?

The built-in security program provided with Windows devices, Microsoft Defender or Windows Security, is a great first-line defence. But given the number and diversity of today’s digital threats, we recommend installing a third-party antivirus application like Norton 360 Deluxe, which provides a powerful additional layer of online protection.

What are four common symptoms of malware?

If something unusual is happening with your device, it’s worth investigating the common signs of malware, including:

• Slow performance, freezing, or crashing
• Unusual browser behaviour
• Fake security alerts
• Suspicious new applications or shortcut files
   

Windows and Microsoft Defender are trademarks of Microsoft Corporation.