“Apple Security Alert” on Mac: a scam, and how to get rid of it

What the scam looks like

The page goes by many names, such as Apple Security Alert, Your Mac is infected with 3 viruses, Apple Defender or macOS Security Center, but it works the same way:

• It fills the browser window, often in full screen, and may play a siren or a recorded voice.
• It shows a fake scan, an Apple logo, a list of viruses and a countdown before your data is “deleted”.
• It gives a phone number for “Apple Support”, and keeps reappearing when you try to close it.

It usually appears after a bad ad, a mistyped web address or a link in an email. The people on the phone pretend to fix your Mac, ask you to install a remote access app, and then charge for support, ask for gift cards or go after your bank account.

How to tell it's fake

• It is inside a browser window. A web page can't scan your Mac or see what is on it.
• Real macOS warnings come from macOS itself, not a web page. When macOS finds malware it says the app will damage your computer and offers to move it to the Trash. It never shows a phone number.
• Apple doesn't call you or ask you to call about viruses, and Apple Support never asks for your password or a verification code.

How to close the pop-up

1. Don't click anything on the page, not even a button that says OK or Close. The buttons are part of the scam.
2. Close the tab with ⌘W, or quit the browser with ⌘Q.
3. If it won't quit, press ⌥⌘Esc, select the browser, and click Force Quit.
4. Open Safari again while holding Shift, so it starts without the windows you had open. In Chrome, Firefox or Edge, turn off Wi-Fi first and close the tab when the browser opens again.
5. If the page still comes back, delete it from your history: in Safari choose History › Show All History, search for the site and delete it.

Is my Mac infected?

Usually not. A page you were sent to by an ad can't install anything by itself. But if pop-ups keep appearing when you aren't on a website, or your browser's home page or search engine changed on its own, something on your Mac is opening them. Check these places:

• Website notifications: in Safari › Settings › Websites › Notifications, set any site you don't recognize to Deny or remove it. Scam sites trick you into allowing notifications, then send fake alerts from the corner of the screen.
• Browser extensions: in Safari › Settings › Extensions, and in your other browsers, remove anything you didn't install on purpose.
• Profiles: in System Settings › General › Device Management, remove any profile you don't recognize, unless your workplace or school manages your Mac.
• Login items: in System Settings › General › Login Items & Extensions, turn off anything you don't know.

macOS's built-in XProtect removes known malware on its own. To check everything above in one go, run a malware scan, such as Tidy My Mac's Adware and Antivirus scans.

If you already called, or let them in

1. Hang up, and disconnect your Mac from the internet.
2. Remove any remote access app they had you install, such as AnyDesk, TeamViewer or a screen sharing tool, and check System Settings › Privacy & Security › Accessibility and Screen & System Audio Recording for apps you don't recognize.
3. From another device, change your Apple Account password and the passwords of anything they saw, starting with email and banking, and make sure two-factor authentication is on.
4. If you paid or shared card or bank details, call your bank now. If you paid with gift cards, contact the company that issued them; they can sometimes freeze the money.
5. Report it: in the US at reportfraud.ftc.gov, elsewhere to your police or national fraud office. Forward scam emails and texts that pretend to be from Apple to reportphishing@apple.com.

How to keep it from coming back

• Keep Warn when visiting a fraudulent website turned on in Safari › Settings › Security.
• Don't allow notifications from websites you don't know, and close any page that asks you to allow them to prove you aren't a robot.
• Keep macOS and your browser up to date, and install apps only from the App Store or their developers' own websites.

Block scam pages with Tidy My Mac

• Web Protection blocks known scam, phishing and malware sites in every browser and app, so the page doesn't load in the first place.
• Adware finds the browser extensions, profiles and proxies that bring pop-ups back, and removes them; Startup Items shows what starts with your Mac.
• Scam Detector checks a message or link you aren't sure about, before you click.