October is Halloween month and Cybersecurity Awareness Month at the same time, which feels about right. Here are three stories to read with the lights on. Each one ends with the version that costs a lot less, and the few habits that actually stop it.

1. The Phantom of the Pop-Up

At home · A made-up story. The scam is real.

Gary has built his own computers since 1987. He has opinions about thermal paste. He is, in his own words, “not the kind of person who falls for this stuff,” which makes him exactly the kind of person this stuff is built for.

It's 9:40 on a Saturday night and Gary is looking up a recipe for pumpkin bread when his screen turns red. A siren wails. A robot voice announces that his computer has been locked “for your protection” and that hackers are stealing his passwords, his photos and, apparently, his pumpkin bread. In the middle of it all, in friendly bold letters: Call Microsoft Support, and a toll-free number.

The mouse won't close it. Escape won't close it. Gary, a man who once revived a hard drive by putting it in the freezer, calls the number.

“Kevin from Microsoft” answers on the second ring. Kevin is calm, kind and very concerned. He has Gary install a “secure support tool,” then opens a window full of yellow warnings and red errors. “Thousands of errors, sir. Your network has been compromised.”

That window is the Windows Event Viewer. A perfectly healthy Windows computer can have thousands of warnings in it. It's like being told your house is haunted because the floor creaks.

Kevin fixes everything for $299. Then he has wonderful news: Gary's old antivirus subscription is being refunded, $299. Gary just needs to sign in to his bank so Kevin can “process it.” The screen goes black for a minute. When it comes back, Gary's checking account has $2,990 more in it than it should.

Kevin is devastated. He typed an extra zero. He will lose his job. Could Gary please send back the difference? Not by check, because the bank's system is down on weekends. In gift cards.

The extra money isn't Kevin's, of course. It's Gary's own savings, moved into checking while the screen was black.

At 10:30 p.m., Gary is at the grocery store with $2,691 in gift cards when the 19-year-old cashier looks up and asks, “Is somebody on the phone telling you to buy these?” Gary looks at his phone. Kevin is still on the line. Gary hangs up.

What actually stops it

• Microsoft's error and warning messages never include a phone number. Neither do Apple's or your internet provider's. A pop-up that tells you to call a number is a scam, every time. More in our fake virus pop-up guide.
• Nobody honest wants to be paid in gift cards. The FTC puts it plainly: only scammers tell you to buy gift cards and give them the numbers off the back, and some stay on the phone while you drive to the store. Microsoft says it will never ask for one. The “we refunded you too much” story is a known script.
• If the pop-up won't close, press Ctrl+Shift+Esc to open Task Manager and end the browser. When you reopen it, don't restore the last session, or the scam page comes right back.
• Scammers love retirees. Americans over 60 reported about $7.7 billion in losses to the FBI in 2025. That's not because they're careless. These scripts are written by professionals.

2. Night of the Living Backup

The office · A made-up story. The failure is real.

Rick runs a four-person property management office. Back in 2019, his nephew Tyler, who is “good with computers,” set up the backup: a USB drive labeled BACKUP DO NOT TOUCH in Sharpie, plugged into the main computer under the front desk, right next to the space heater.

The backup software was set to email a report every night. To Tyler.

Tyler moved to Denver in 2022.

In March 2024 the backup drive filled up. That night, the software dutifully emailed Tyler a message that said BACKUP FAILED. It did the same the next night, and the night after that, and it has done so faithfully ever since: 947 cries for help into an inbox nobody has opened since Tyler started skiing.

Then, one Friday the 13th, the computer under the desk starts making a noise. Click. Click. Click-click. Like a very small woodpecker who has made a terrible decision.

Rick is calm. “That's fine. We have a backup.”

He restarts the computer fourteen times, because maybe it will get better with encouragement. (It will not. A clicking drive gets worse every time it spins up.) Then they plug the backup drive into a laptop and open it.

The newest file is from March 2024.

Every lease, every work order and every owner statement from the last two and a half years now lives on one drive making woodpecker noises. Somewhere in the building, a violin plays one long, high note.

What actually stops it

• A backup nobody watches is a rumor. Failure alerts have to reach someone who reads them and whose job is to act on them.
• Follow 3-2-1: three copies of your data, on two kinds of storage, with one offsite. A drive sitting next to the computer doesn't survive a fire, a flood, a theft or a lightning strike. Our backup strategy guide explains each part.
• A drive that's always plugged in isn't safe from ransomware. Ransomware can encrypt anything the computer can reach, backup drive included. CISA, the federal cybersecurity agency, recommends offline, encrypted backups that are tested regularly.
• Test a restore. Monitoring shows a backup ran. Only a restore shows the files actually come back.
• If a drive clicks, power it off and leave it off. Every restart makes recovery harder. Read The First Hour After a Drive Fails.

3. The Invoice From Beyond

The business · A made-up story. The scam is real.

Dana is the office manager at a pool service company. Every month she pays the chemical supplier about $18,000 for chlorine and acid. Same invoice, same rep, same bank, for six years. The rep is Brenda, who signs every email “Have a blessed day!! Brenda,” with two exclamation points, every single time.

Here's what Dana doesn't know. Three weeks ago, Brenda clicked a “shared document” link and typed her password into a page that only looked like Microsoft. Since then, someone else has been reading Brenda's email. They read every invoice. They learned the payment schedule. They learned the two exclamation points. They even set up a rule that quietly files any reply mentioning “bank” or “payment” into a folder Brenda never opens.

At 3:52 on a Friday afternoon, a message arrives in the real email thread, from Brenda's real address:

It's perfect. It's in the real thread. It even has the typo Brenda always makes in “recieve.” Dana pays.

Thirty days later, the real Brenda calls. Where's the payment? “We paid it,” says Dana, “to your new bank!” There is a long pause. “What new bank?”

The money landed in an account opened for exactly one purpose and was gone within hours. What comes next is the scariest part of all: two businesses that have liked each other for six years, arguing about who eats $18,000.

What actually stops it

• No bank detail changes by email. Ever. Any new account number or “updated wiring instructions” get confirmed by phone, at a number you had before the email arrived, never one from the email. The FBI gives the same advice. Write the rule down so everyone in the office follows it.
• Turn on multi-factor sign-in for every mailbox, so a stolen password alone doesn't open it.
• Look for hidden inbox rules. A rule that forwards or hides mail about payments is one of the clearest signs someone else is inside a mailbox.
• If the money already went out, call your bank right away and ask them to contact the bank that received it, then report it at ic3.gov. Hours matter. The full playbook is in Wire Fraud and Fake Invoice Emails.
• This is big business. The FBI's 2025 Internet Crime Report counted nearly $21 billion in reported losses and named compromised business email among the costliest tactics.

Sources

The stories are fiction. Every fact in the “what actually stops it” lists comes from one of these, or from the Bay Geeks guides linked above.

• Microsoft, Protect yourself from tech support scams: error messages never include phone numbers, scammers misrepresent normal system messages, and Microsoft never asks for gift cards.
• Federal Trade Commission, How To Spot, Avoid, and Report Tech Support Scams: the “refunded you too much” script, and Avoiding and Reporting Gift Card Scams: only scammers ask for gift card numbers.
• FBI, Cryptocurrency and AI Scams Bilk Americans of Billions (April 6, 2026), on the 2025 Internet Crime Report.
• FBI, Business Email Compromise: verify payment changes on a known number, and call your bank at once.
• CISA, #StopRansomware Guide: offline, encrypted backups, tested regularly.

Related guides

All guides →

📞 727-579-4335  ·  ✉️ support@baygeeks.com  ·  Privacy Policy  ·  Terms of Service