Short answer: if a full-screen red warning with a siren, a countdown and a phone number appeared inside the browser, it is an advertisement, not a detection. Nothing has scanned your phone. Close the tab and it is over.
How to tell a scare advert from a real compromise
- It appeared in the browser, on a page you did not deliberately open, often after tapping a link in a message or an ad. Adverts cannot see inside your phone. They are a picture.
- It gives you a phone number and a countdown. Legitimate operating-system warnings do not ask you to call a number or beat a timer.
- It wants a card, a gift voucher, or remote access. That is the entire business model.
Close the browser tab. If the page will not close, close the browser itself; if that fails, restart the phone. Then clear the browser’s history and open tabs so it does not return.
The signs that mean it is actually compromised
- You cannot sign in to an account, or the password was changed without you.
- Messages are arriving from your own number, or your contacts get messages you did not send.
- Two-factor prompts appear when you are not trying to sign in. That means someone has your password.
- An unfamiliar device is signed in to your mail, your cloud storage or your messaging account.
- Apps you did not install are present, especially ones with device-administrator rights or accessibility access.
- Battery and data use jumped with nothing new installed, and the phone is warm at idle.
These are account-level and device-level facts. They are worth acting on; a red picture in a browser is not.
What to do if it is real
- Change the password on your email from a different device. Email is the reset route for everything else.
- Turn on two-factor authentication, and prefer an app over SMS if you can.
- In your account’s security settings, sign out of all devices, then sign back in on the ones you recognise.
- Check for forwarding rules and auto-delete rules in your mailbox that you did not create.
- On the phone, remove apps you do not recognise — particularly any with accessibility or device-admin access — and revoke that access.
- Update the operating system. Many compromises are months-old, already-patched holes.
What not to do
Do not install a “cleaner” app that the warning page recommends. Do not let a caller you did not contact take remote control of the phone because they said they were from support. Do not pay to unlock a phone that is showing an advert — you would be paying to remove a picture.
Questions people ask
Can a phone get a virus from a website? Modern phones sandbox applications heavily, so a webpage usually cannot install software silently. What it can do is steal a session, which is why account security matters more than malware scans.
I tapped the link — am I infected? Tapping is not installing. If nothing was downloaded, nothing was granted permission, and no password was typed, you are almost certainly fine. If you typed a password on that page, change it now.
Does a factory reset fix it? It fixes the device. It does not fix an account someone else is already inside — do the account steps first, or you will restore the sessions along with your data.