What the DOJ filing actually says
The guilty pleas come from Adam Young, 42, of Miami, Florida, who served as CEO of Ringba, and Harrison Gevirtz, 33, of Las Vegas, Nevada, who served as CSO. Ringba is a pay-per-call analytics and routing platform that sells phone numbers, call tracking, call routing, and call forwarding services. Those services have legitimate marketing uses. The DOJ charge is that Young and Gevirtz knew, from 2016 through April 2022, that some Ringba customers were operating tech-support fraud schemes and continued to provide infrastructure to them anyway. The charge specifically is misprision of a felony, which is the federal crime of having knowledge of an ongoing felony and failing to report it. Sentencing is scheduled for June 16, 2026.
The DOJ filing also notes that the case grew out of an earlier investigation beginning in 2020 that already led to convictions of five India-based telemarketing fraudsters and a former Ringba employee. The pipeline the prosecutors describe is straightforward: U.S.-based call-routing infrastructure feeds calls to India-based call centers where fluent English-speaking agents pose as Microsoft or Apple support technicians. Victims are walked through fake remediation steps and charged hundreds to thousands of dollars per call. The prosecutors' filing emphasizes that the targets were "the elderly" and victims were "drained of their life savings and peace of mind."
This is the highest-profile U.S. enforcement action against a tech-support fraud infrastructure provider in 2026 to date. It matters because it sets precedent: providing telecom services to known fraudsters can land company executives in federal prison, not just the call center operators themselves.
How the fake Microsoft popup actually works
The scam starts in the user's browser. The user visits a website. The site can be anything: a free movie streaming site, a torrent landing page, an adult content site, a recipe blog, even a legitimate ad network that has been compromised. The page loads a script that displays a full-screen popup mimicking a Microsoft Windows Security alert, an Apple system warning, or a generic browser security notice.
The popup typically claims that the computer has been infected with malware, that personal data has been compromised, that the system has detected suspicious activity, or that pirated software has been detected. A loud beeping sound usually plays in the background. The browser may be put into fake fullscreen mode and trapped so the back button does not work. The popup tells the user to call a phone number immediately and warns that closing the window will destroy the operating system or get the user reported to authorities.
The phone number is the key. It is routed through call-tracking infrastructure (this is where Ringba and similar platforms fit in) to a call center, often in India, where the agent picks up posing as "Microsoft Support" or "Apple Senior Technician." The agent walks the victim through downloading a remote-access tool like AnyDesk, TeamViewer, or QuickAssist, then takes control of the victim's screen. From that point the agent can install actual malware, harvest banking credentials, or simply convince the victim to wire money for "premium support."
The whole pipeline is built so the browser popup is the trigger. No popup means no call, no call means no scam. Browser-level defenses that block the popup at step one cut the entire chain.
Why this scam keeps working on elderly victims
The popup-to-call-center model is older than most modern crypto scams, yet it still drains hundreds of millions per year. Three factors make it durable.
First, the fake popup looks legitimate. Microsoft Defender Security Center is a real Windows feature. Apple does sometimes display security alerts. The popup that imitates these designs is visually close enough that a user who has not seen the real thing recently cannot tell the difference. Older users in particular have learned to take security alerts seriously, which is exactly the response the scam relies on.
Second, the call center model is friendly. Unlike crypto drainers that operate in seconds, tech-support scams take 30 minutes to two hours of conversation. The agent is polite, patient, and conversational. They walk the victim through "diagnostics," show fake "virus counts" on the screen, and build rapport. By the time payment is requested, the victim has invested significant emotional energy in the interaction and feels they have a relationship with the helpful technician.
Third, payment methods are designed to be irreversible. Common asks include gift cards (Target, Apple, Google Play), wire transfers, and cryptocurrency. None of these can be clawed back by a bank dispute. Once the victim authorizes the payment, the funds are gone. The FBI's IC3 division has been warning about this since 2017 and the warning has not stopped the scam from working.
The Ringba case and why it matters for browser security
Most tech-support fraud enforcement to date has targeted the call centers or the individual operators. Convicting the infrastructure layer is rarer. The Ringba pleas signal that the DOJ is willing to go upstream of the actual scam call to the companies that make the call possible. Future cases may follow.
From a user-protection standpoint, infrastructure enforcement is welcome but slow. The Ringba investigation began in 2020 and reached guilty pleas in 2026. That is six years during which the same scam continued running. Users cannot wait for federal prosecutions to catch up. The protection has to come at the moment the popup loads, before the user dials.
The same DOJ filing notes that Young and Gevirtz "willfully profited from telemarketing and tech support scammers, here and abroad, who preyed on the elderly, exploited the vulnerable, and drained victims of their life savings and peace of mind." Translated into prevention terms: the scam runs at scale because the call-routing infrastructure runs at scale. Until the next infrastructure provider gets convicted, the popup-to-call-center model continues. Browser defense is the only layer with the latency to keep up.
How SafeBrowz blocks fake Microsoft popups
The SafeBrowz extension treats fake security popups as one of its highest-priority detections. The blocking happens in three layers.
The URL pattern layer flags pages that load known tech-support scam domain patterns. Pages that contain strings like your-windows-defender-blocked, microsoft-security-alert, apple-malware-detected, system-warning-call-now, or computer-virus-detected in the URL or first-paint content are blocked before any popup renders.
The content layer scans the rendered page for tech-support scam fingerprints. The combination of a fullscreen lock attempt, a beeping audio file, a fake Microsoft or Apple logo, a phone number rendered in a "call now" CTA, and a "your computer is infected" headline triggers an immediate danger verdict regardless of the URL. The AI scan recognizes the visual layout pattern across hundreds of variants the SafeBrowz team has seen in the wild.
The brand impersonation layer catches pages that render the Microsoft Windows logo, the Apple logo, or the Defender shield on a domain that is not on the official brand allow-list. Microsoft's real security alerts only ever appear in the operating system, never in a browser popup. Apple's real alerts only ever appear in macOS or iOS native UI. Any web-rendered version of these UIs is a scam by definition. SafeBrowz flags them as brand impersonation.
For Premium users, the wallet-drainer JavaScript scanner also catches the audio autoplay and fullscreen-lock attempts that tech-support scam pages use. The Premium tier shows a full-screen warning that explicitly names the technique (fake Microsoft Defender popup, fake Apple security alert) so the user understands what was just attempted on their browser.
Specific red flags users can check in 10 seconds
- The popup demands a phone call. Microsoft, Apple, Norton, McAfee, and other real security vendors never display a popup that tells you to call a number. Real security alerts always direct you to settings inside the operating system or inside the product UI. A browser popup with a phone number is a scam every time.
- The browser is locked in fullscreen and the back button does not work. Legitimate websites do not trap the browser. If the back button is disabled, the close button is hidden, or the page goes fullscreen without explicit permission, the page is using anti-escape tactics typical of tech-support fraud.
- The page is playing a loud beeping or warning sound. Real operating system alerts do not autoplay audio in a browser tab. A browser tab that produces a beeping security alert is a scam page.
- The popup mentions a "Windows License Key" or "Apple ID compromise" with a number. Microsoft does not call users about Windows licenses. Apple does not call users about Apple ID issues. Both companies only communicate through their account UI or through verified email addresses sent to the registered account address.
- The agent on the phone asks you to download AnyDesk, TeamViewer, QuickAssist, or any remote-access tool. Real Microsoft and Apple support does use remote tools, but only after the user opens a support ticket through the company's official website and is given a session code. A cold call that immediately asks to remote-control your screen is fraud.
What to do if you already called the number
If you called the number but did not give any information or download anything, hang up. There is no harm yet. Make a note of the source page if you can, and report it to the FBI's IC3 portal at ic3.gov. Reporting helps prosecutors build the next case.
If you downloaded a remote-access tool, disconnect from the internet immediately. Unplug the Ethernet cable or turn off Wi-Fi. Restart the computer in safe mode. Uninstall AnyDesk, TeamViewer, QuickAssist, or whatever was installed. Run a full antivirus scan with Windows Defender or a reputable AV product. Change every password from another device, starting with email and banking.
If you paid the scammer, the money is likely gone. Wire transfers and crypto payments cannot be recovered. Gift card payments are almost never recoverable but contact the card issuer immediately just in case. Credit card payments may be disputable depending on the issuer's fraud policy. File a report with your local police and with IC3 even if recovery is unlikely. The report becomes evidence for future prosecutions like the Ringba case.
The recovery walkthrough is similar to other browser-driven scams. Our wallet drained recovery guide covers the credential rotation and device wipe steps in more detail, and the procedure transfers to non-crypto tech-support fraud too.
How this case connects to other browser scams of 2026
The Ringba prosecution targets one specific monetization pipeline (popup → call center → fake support payment) but the same browser surface delivers a half-dozen other scam types in 2026. Crypto wallet drainers use the same popup primitive but ask the user to "verify wallet" instead of call a number. ClickFix attacks use the same browser-lock tactic but ask the user to paste a PowerShell command instead of dial. Fake captchas use the same urgency to trick users into running info-stealer downloads. The thread is the browser as the attack surface.
Each variant has its own defense story. For tech-support fraud specifically, the defense is to block the popup before the phone number renders. For ClickFix, see our ClickFix explained piece on how the same primitive delivers PowerShell info-stealers. For wallet drainers, see our Permit2 signature attack deep dive on how the same urgency triggers Permit2 batch signatures. The infrastructure is shared, the defense layer is shared, and SafeBrowz catches all three on the same scan.
The bigger picture: who pays for the cleanup
The Ringba case is good news, late news, and incomplete news in equal measure. Good because it sets precedent for prosecuting infrastructure providers. Late because the harm to victims occurred over six years before the pleas. Incomplete because most tech-support call routing in 2026 happens on platforms outside U.S. jurisdiction. Indian and Filipino call routing providers do not pause when a U.S. DOJ indictment lands. They re-platform, rebrand, and keep selling.
The realistic protection model is layered. Federal prosecution removes the worst infrastructure providers slowly. Phone carriers add anti-spoofing filters at the call layer. Search engines de-rank known scam landing pages. Browser extensions block the popup before it renders. Each layer catches some fraction of the attempted scams. The user is the last line, which means user education and user-side tooling matters more than legal enforcement until the infrastructure layer is properly regulated.
That is what SafeBrowz exists to do at the browser layer. The free tier blocks fake Microsoft and Apple popups, lock-the-browser tactics, audio-warning autoplay, and known scam call-now landing pages across 500+ brands and 100+ languages. The Premium tier adds AI scan for variants the local rules do not catch yet plus wallet-drainer JavaScript signature detection. Both are available on Chrome, Firefox, Edge, Brave, Opera, and Vivaldi.
Block fake tech support popups before you call
SafeBrowz is a free browser extension for Chrome, Firefox, and Edge that blocks fake Microsoft popups, fake Apple security alerts, browser-lock pages, and known tech-support fraud landing pages in real time. Premium adds AI deep scan for new variants and wallet drainer protection. The core protection is free forever.