What should I do if a Mac popup says a virus was found and asks to scan or cancel?
Answer
Treat unexpected Scan or Cancel virus popups as scareware until proven otherwise. Close the page without clicking Scan, then check the Mac with built-in tools or reputable security software only if you still see signs of a real problem.
Before you start: stop right away if…
- Fake virus popups often try to get you to call a number, install remote-access software, or pay for cleanup you do not need.
- Only download security software from the vendor’s official site or the Mac App Store.
Follow these steps
Leave the fake alert without scanning
Do not click Scan. Try Cancel only if it simply closes the page. If the page traps you, press Command-Q to quit the browser, or use Apple menu > Force Quit, select the browser, and click Force Quit.
You should see: The scareware page closes and the Mac desktop returns to normal.
Reopen the browser safely
Reopen the browser while holding Shift if needed to avoid restoring the bad page, or clear recent tabs for that site. Confirm the warning does not return on ordinary websites.
You should see: Browsing works without the fake virus page reappearing.
Run a careful check with trusted tools
If downloads were clicked or the Mac still behaves oddly, update macOS, review Login Items and installed apps you do not recognize, and run a full scan with Apple’s built-in protections or a security tool you already trust from an official source.
You should see: No unknown apps remain, and a trusted scan reports a clean result or identifies something specific to remove.
Ignore callback scam follow-ups
If the popup showed a phone number, do not call it. Use Apple Support or your chosen security vendor only through official websites or apps you open yourself.
You should see: You avoid remote-access and payment scams tied to fake virus alerts.
Not sure this is the right page? Check here
0 of 6 checked
Extra tips
What to look for: A browser page or pop-up that says your Mac is infected, plays an alarm sound, counts down, or pushes Scan Now, Call Support, or download buttons.
Before you change anything: Do not click Scan, Allow, or Call on the popup. Do not give remote-access software control to anyone who called you about the alert. Note the browser name and whether the warning is inside a webpage versus a real macOS System Settings alert. Never share passwords or one-time codes with unexpected callers.