If you’ve spent any time browsing lately, you may have run into a full-screen popup warning you that your Apple ID or Amazon account was just used for a mysterious $149.99 purchase. It looks urgent. It looks official. And if you look at two examples side by side, it becomes obvious that it’s neither.
Below are two popups pulled from real pages—one dressed up as Apple Support, one as Amazon.
Same con, two costumes
Below, one popup is skinned as Apple Support, the other as Amazon. Swap the logo and color palette and the structure is identical: a warning icon, a claim that a $149.99 purchase was just made “via Pre-Authorization,” and a phone number to call immediately. That phone number is exactly the same in both.
That reused phone number is the tell. If you only see one popup, running the number through a lookup tool like Malwarebytes Scam Number Check is usually enough to expose it—a real Apple or Amazon line won’t come back flagged, but a scam number typically does, often tied to complaints about several unrelated companies at once.
Why the copy is built the way it is
Every element in these popups is doing specific psychological work:
- A believable, moderate dollar amount. $149.99 is high enough to alarm you, low enough to sound like a real subscription or product charge rather than an obvious lie.
- “Pre-Authorization” jargon. This is real payment terminology (used for things like hotel holds or gas station charges), borrowed here to sound technically credible to someone who doesn’t handle payments professionally.
- Manufactured urgency. “Call immediately,” “Immediate Action Required,” “no hold times”—all are designed to get you dialing before you stop to verify anything.
- Visual authority. Red warning triangles, brand-matching fonts and layouts, and a full-screen modal that blocks the rest of the page all borrow the visual language of legitimate security alerts.
- A single, frictionless call to action. One button, one phone number. The popup wants exactly one thing from you: to pick up the phone.
If you do call, the number connects to a live scammer posing as support staff, whose actual goal is to get remote access to your device, walk you through “verifying” your identity in a way that hands over real account or payment info, or push you toward paying a fake fee—often via gift cards or a wire transfer.
How to tell if it’s fake
A few checks work regardless of which brand is being impersonated:
- Real companies don’t alert you this way. Apple and Amazon notify you about account activity through email, in-app notifications, or your account’s activity log—never through an unexpected popup while you’re browsing.
- No legitimate company tells you to call a phone number to stop a charge. Disputing a charge happens through your bank, your card issuer, or the company’s actual account dashboard—not a hotline dictated by a popup.
- Check where the popup is actually served from. These often ride in on malicious ads, compromised sites, or browser redirects—the underlying page may be spoofed or injected, not the real apple.com or amazon.com support page it appears to sit on top of.
- A popup you can’t easily close is a red flag on its own. Legitimate sites don’t need to trap you behind a full-screen modal to relay account information.
- If in doubt, go direct. Close the tab (force-close via task manager if needed) and navigate to the company’s site yourself, or call the number printed on your card or official account page—never the one in the popup.
- Check the number before you dial it. Run it through Malwarebytes Scam Number Check to see if it’s already been flagged as a scam line.
- Block it before it loads. A browser extension like Malwarebytes Browser Guard catches both known malicious pages and unknown ones showing scam-like behavior, so these popups often get stopped before they ever render.
Don’t judge a scam by its logo
The brand on screen—Apple, Amazon, or whoever’s next—is the least important part of this scam. What actually matters is the pattern underneath: an unexpected popup, a suspiciously specific dollar amount, urgent language, and a phone number that wants you to call before you think. Once you recognize that pattern, it doesn’t matter which company’s name is stamped on top of it.
