On this page
An alarming notification says your device is infected and urges you to call a number, renew a subscription, or install a cleaner. The message may come from a website that received notification permission. Its appearance outside the original tab does not make it an operating-system diagnosis.
Do not use the notification's phone number, download button, or payment link. Identify the sending application and site through the browser or operating system's own controls. Then address the permission or wider security issue based on what you actually find.
Separate the message from its claimed authority
A notification can display a security brand, logo, or urgent wording without coming from that company. Read the source information exposed by the notification or notification center, but avoid clicking its content to investigate.
If you use a security application, open it through its established application icon or system settings and check its own status. Do not assume that a web page claiming to represent it is equivalent to the installed product.
The online scam recognition guide covers the pressure tactics often used in these messages. The immediate task is to reach trustworthy controls without continuing the conversation the alert is trying to start.
Find which browser or application sent it
Look for the application name shown by the operating system. If several browser profiles are in use, identify the profile where the site permission was granted. Changing a setting in a different browser may leave the original notification source active.
On a managed work or school device, use the organization's support route if the relevant setting is controlled or the source is unclear. Do not remove managed security software or alter organizational policies in response to a website's instructions.
If the alert is a page or pop-up rather than a notification, close the suspect tab through the browser's normal controls. Avoid buttons drawn inside the page that pretend to close an operating-system warning. If the browser is unresponsive, use the device's normal application-closing process and follow provider guidance.
Review site notification permissions
In current Chrome desktop settings, notification controls are under Privacy and security, Site Settings, and Notifications. Google's documentation describes allowing or blocking individual sites. Other browsers and mobile systems use different paths, so consult their current support instructions.
Find the unfamiliar or unwanted site in the permission list and block or remove its notification permission using the browser's own control. Check the address carefully so you do not disable a legitimate service by mistake.
You do not need to revisit the suspicious website to revoke its permission. Avoid granting new permissions while following instructions from the unwanted message. If you cannot confidently identify the source, ask trusted support to inspect the relevant setting rather than trying random cleanup tools.
Understand what revoking permission does
Removing notification permission stops that site's authorized notification channel under the browser's rules. It does not prove the device is free of unwanted software, recover information already entered, or reverse a payment.
Likewise, a notification already stored in the operating system's history may remain visible after permission changes. Dismiss the old notification through the normal notification-center controls and distinguish it from a newly arriving message.
Keep a short record of the site name and action if you need to explain the issue to support. Do not repost a clickable malicious link or an unredacted screenshot containing private information in a public forum.
Check for symptoms beyond notifications
Google's unwanted-software guidance lists behaviors such as persistent new tabs, unexpected redirects, returning extensions, and browser settings changing without permission. Those observations call for a broader review than blocking one site's notifications.
Inspect installed extensions through the browser's normal management page. Remove only items you can identify as unwanted and are authorized to remove. If an extension is managed by an organization, contact the administrator rather than trying to bypass management.
Use the device's established security tools and current provider guidance for scanning and remediation. Do not install a product advertised by the alert that triggered the investigation. A clean scan is useful evidence within the tool's limits, not a guarantee that every possible risk has been eliminated.
Match recovery to what you actually did
If you only saw the message, focus first on its source and permission. If you entered a password, use the affected provider's security process from a trusted device. If you supplied payment details or transferred money, contact the relevant financial provider through an established route promptly.
If you installed software, allowed remote control, or granted unusual device permissions, tell trusted support exactly what occurred. Do not minimize the action because the person on the phone sounded professional. Equally, do not assume every notification means someone has remote access.
The access review after a password reset explains why account recovery can require checking sessions and connected applications as well as changing a password.
Keep browser maintenance separate from a reset
Update the browser and operating system through their normal update mechanisms. Review unnecessary permissions and extensions, and retain security protections such as the browser's unsafe-site warnings.
A full browser reset is a broader action that can change useful settings. Do not begin there without understanding what the provider's reset affects and how important work, profiles, or extensions will be handled. Follow the documented procedure if the evidence makes it appropriate.
The browser privacy settings guide covers the ordinary controls. A targeted permission change is easier to verify than a series of unrelated cleanup actions performed at once.
Verify the specific improvement
Confirm that the unwanted site no longer has notification permission in the relevant profile. Observe whether new alerts continue and whether their source is the same. If another site sends similar messages, investigate that permission separately rather than assuming the first change failed.
Check any wider symptoms you identified, such as an unwanted extension or changed home page, through the appropriate support process. Record unresolved behavior so the next person does not have to reconstruct it from memory.
The useful endpoint is a known notification source that has been disabled, plus an appropriate response to any additional exposure. You should be able to explain what was changed and what evidence supports the result without trusting the original alert's claims.
Sources and further reading
Primary and contextual sources used to verify definitions or give readers a relevant next resource.
- Google: Chrome notification settings Chrome provides site-specific notification permissions and controls for reviewing or blocking unwanted notifications.
- Google: Unwanted ads, pop-ups, and malware Persistent redirects, unwanted extensions, and changing browser settings can require a broader unwanted-software investigation.