Feds bust two fake antivirus sellers for millions in fraud

If you frequent certain portions of the internet, you’ve almost certainly seen pop-ups warning you that your PC is infested with all manner of creepy-crawly viruses. The ad is fake, and so is the software that it asks you to pay for, according to a new Federal Trade Commission lawsuit against a pair of phony antivirus sellers.

FTC investigators allege that Restoro and Reimage, two companies run out of the same office in the Republic of Cyprus, have been scamming customers with fake antivirus software for years. The two companies have settled with American investigators for $26 million USD, which the FTC says will be used to “provide redress” to the companies’ victims. Both companies will be prohibited from misrepresenting technical problems or distributing deceptive products or services in the US.

It’s a pretty simple setup: A pop-up ad posing as an official Windows alert tells you your PC is infected with a virus, complete with a timer that says permanent damage is imminent if you don’t download an antivirus program right-the-hell-now. Once you install the program, which costs between $27 and $58, you have to call a number to “activate” it.

The software does nothing, and the number you called puts you on a spam list for even more fraudulent services. The FTC says that the two companies could sometimes bilk hundreds of dollars more out of victims by offering live remote “support.” According to a report from Court Watch, the “technicians” often loaded up Windows Event Viewer to demonstrate “trojans” and “viruses” in action, then upsold the service for another two to five hundred dollars to fix the non-existent problems.

This is basically the equivalent of a car mechanic pointing to your seat belt and saying your transmission is shot. Unsurprisingly, these sorts of scams tend to target older consumers or those who are less tech-savvy, overloading them with technical jargon to create confusion. During the FTC’s years-long investigation they caught the remote technicians presenting VirusTotal reports from entirely separate computers as evidence that their victim’s PC was infected.

Restoro and Reimage often found victims by using otherwise legitimate vectors, like Google ads. Viruses, trojans, malware, and other dangers are real, but misrepresenting them is an easy way for scammers to find a mark. Most people are fine with the built-in Windows Security (AKA Windows Defender).

If you’re looking for some (legitimate) advanced protection, check out PCWorld’s choices for the best antivirus software. We’ve run real tests and comparisons to find the best tools that offer real defense from the worst the web can offer.