Fake Police Pop-Up Alerts Are Back: How to Brief Your Staff

What SPF said on 20 September 2026

The SPF advisory of 20 September 2026 describes a re-emergence of phishing scams that use fake pop-up alerts impersonating the police. It is a short notice, but it gives enough detail to recognise the pattern.

According to SPF, victims only realised they had been scammed when unauthorised foreign-currency transactions appeared on their cards, often for more than the fake fine. The police state plainly that these alerts are not issued by SPF and that the police do not remotely lock computers or laptops or demand payment through pop-ups.

How a fake pop-up appears on an office PC

These alerts are web pages, not messages from Windows or the police. Staff usually land on them through a misleading ad, a mistyped web address, a link in a message, or a site that asked to show notifications and was allowed. Microsoft's page on tech support scams describes the same trick: the page switches the browser to full screen and keeps showing pop-ups so it looks as if the computer is locked.

The computer is not actually locked. Files are not encrypted and the police are not watching. The page only controls what is inside the browser window, which is why closing the browser ends it. That is different from real ransomware, which encrypts files and usually appears outside the browser. If you are unsure which one you are looking at, our ransomware first-hour guide shows the signs of the real thing.

What staff should do in the first minute

Print these steps or pin them in your team chat. They work on Windows PCs in Edge, Chrome and Firefox.

1. 1

   Do not type anything into the pop-up

   No card number, no phone number, no password. Do not call any number shown. Microsoft notes that genuine error messages never include phone numbers.

2. 2

   Try to close the tab or press Esc

   Press Esc to leave full screen, then close the tab or the whole browser window. Ignore buttons inside the page, including ones that say Close or Cancel; they can be part of the scam.

3. 3

   If it will not close, end the browser in Task Manager

   Press Ctrl + Shift + Esc, select the browser (Microsoft Edge, Google Chrome), and choose End task. This always closes the page.

4. 4

   Do not restore the previous session

   When you reopen the browser, decline any offer to restore tabs, or the fake page comes back.

5. 5

   Tell IT or the owner, even if nothing was paid

   Send a short message with the time and what you were doing before it appeared. The website or ad that led there may need blocking for everyone.

6. 6

   If card details were entered, call the bank now

   SPF advises reporting fraudulent transactions to your bank immediately. Ask the bank to block the card, then make a police report. Call the ScamShield Helpline on 1799 if you are not sure.

Browser settings that help on office PCs

Most of this is free and already in Windows and Edge. The goal is to stop scam pages before they load and to make sure no one can switch protections off.

Microsoft's SmartScreen documentation notes that by default users can click past SmartScreen warnings, and recommends reviewing the Group Policy settings for organisations. Edge also has a Scareware blocker that uses a local AI model to detect tech scam pages. Microsoft's policy page says it is on when the policy is enabled or not configured, and supported from Edge 134 on Windows.

Notifications matter because many scam pop-ups start as a site asking "Allow notifications?". Once allowed, the site can push alerts that look like system messages, even after the tab is closed. Blocking notifications by default, and clearing old site permissions, removes that route. If you are already managing extensions, our guide to malicious browser extensions covers the related policies.

A one-page staff note you can send today

Keep the message short. People remember three rules, not twenty. Here is wording you can adapt for email or your team chat.

• The police never lock your computer or ask for fines in a pop-up. SPF confirmed this on 20 September 2026.
• Never type a card number into a pop-up or call a number on it. Not for the police, a bank or Microsoft.
• Close it: press Esc, close the browser, or press Ctrl + Shift + Esc and end the browser task.
• Tell us straight away, even if you think you clicked something embarrassing. You will not be in trouble.
• If you entered card details, call the bank to block the card first, then tell us.

The fourth line is the important one. These pop-ups accuse people of viewing illegal content because shame keeps them quiet. A clear no-blame rule gets reports in early, before a card is used. For a wider refresher, see our guide on how to spot phishing emails.

Where to report and check

SPF's advisory follows its usual Add, Check, Tell advice. Add the ScamShield app and set transaction limits and two-factor authentication for internet banking. Check suspicious messages, numbers and links on the ScamShield website. Tell the authorities and your bank, and report phishing websites to the browser provider.

If a staff member did let a stranger connect remotely, treat it as a security incident (our Microsoft tech support scam guide covers that case), not just a pop-up. Microsoft advises uninstalling anything the scammer asked you to install, running a full scan, changing passwords and contacting the card provider.

Do it yourself or get help?

A business with a few PCs can do most of this in an afternoon: send the staff note, check that SmartScreen and updates are on, and block notifications in each browser. It gets harder when PCs are not centrally managed, staff have admin rights, or you cannot tell which antivirus is running where.

Our Security Awareness Training (S$390) gives your team a short session and a written briefing on pop-up, phishing and payment scams. If your PCs need a consistent baseline, the Antivirus & Endpoint Protection Rollout (S$390) sets up protection and browser policies on every machine. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing through the site chat or contact form, and track progress on your order page.