Computer Repair · October 28, 2026 · ComputerKing Team

A Pop-up Says Your Files Are Encrypted — Does That Mean Ransomware? Telling Real Encryption, Fake Pop-ups and Extortion Emails Apart

A pop-up saying your files are encrypted does not mean they are encrypted. Use five checks to tell real encryption, fake pop-ups and extortion emails apart: real encryption means stop and follow the first-response sequence, fake warnings mean do not click, do not call the number on screen, and do not hand over remote control.

Key points

• A pop-up that says your files are encrypted does not mean your files are actually encrypted. Many are only fake warnings inside the browser, designed to get you to call a number or hand over remote control.
• Real encryption, fake browser pop-ups and extortion emails are three different situations, and they need completely different responses. Mixing them up is how wrong decisions get made.
• Tell them apart with five checks: whether files open, whether extensions changed, where the message appears, whether the browser can be closed, and whether the sender can produce real evidence.
• Real encryption has only one direction: stop, isolate the machine and follow the first-response sequence. The details are in this site's first-response and recovery guides, and are not repeated here.
• Fake pop-ups and extortion emails share one rule: do not click, do not reply, do not pay, do not hand over remote control. Take a photo of the screen for your records first, then act.

Introduction

Your computer suddenly shows a warning saying your files have been encrypted and you must call a number or pay to get them back. Or an email arrives saying someone has taken your data and will publish it unless you pay by a deadline. In that moment, most people's first reaction is panic, and panic pushes people to do exactly what the message says. Before that, it is worth stopping to ask one question: is this warning real or fake?

The answer is not just "attacked" or "not attacked". In everyday practice there are three situations. The first is real encryption: files genuinely will not open. The second is a fake browser pop-up: the files are completely fine and the warning is only a web page. The third is an extortion email: nobody has encrypted anything, and the sender is only using words to scare you into paying. The three differ greatly in severity, and their responses are completely different. Treating a fake pop-up as real encryption wastes time and money. Treating real encryption as a fake warning, and carrying on using the machine, makes the loss bigger.

This article covers only the telling-apart stage and the first step for each situation. The full first-response sequence for real encryption is already covered in another article on this site, and the return-to-work recovery sequence has its own dedicated article. This article will not repeat those two, and will point to them where they apply.

What this article covers, and what it does not

This article covers the period before you are sure whether encryption is real: how to tell within a few minutes which situation you are facing, what the first step is for each one, and which reactions must never happen.

It does not cover the full first-response process or the recovery sequence after real encryption. If the checks below confirm real encryption, go straight to "Ransomware Response Guide for Hong Kong SMEs: First Steps & Recovery" (https://www.computerking.hk/en/blog/ransomware-response-hk-guide/) and follow its first-response sequence. For the recovery stage, see "After a Ransomware Attack, How Do You Get Back to Work? Restore or Reinstall, Resetting Passwords, and What to Check Before Reconnecting" (https://www.computerking.hk/en/blog/ransomware-recovery-roadmap/).

First table: three situations at a glance

This table is only a starting point. No single sign is enough for a conclusion. Do the five checks below, one by one.

Five checks, in order

Check 1: Do the files open, and have extensions changed?

This is the most direct check. Open a few files you normally use, not just one: pick a document, a photo and a spreadsheet from different folders.

• If many files will not open and their extensions have changed to an unfamiliar string, that points to real encryption.
• If all files open and their contents are normal, that points to a fake warning, and the files themselves are fine.
• Watch one trap: a single file that will not open does not mean ransomware. It may only be that one file damaged, or a program problem. Look for whether a whole batch of files fails together.

Check 2: Where does the ransom message appear?

Where the message appears is itself a clue.

• A real encryption ransom note usually appears in many folders as a text file, and it stays there even after the browser is closed.
• A fake pop-up warning only appears inside a browser tab. Once the browser is closed, the warning disappears, and the message cannot be found anywhere else on the system.
• An extortion email message only exists inside the email. Nothing else on the computer is abnormal.

Check 3: Can the browser be closed?

Fake pop-ups love to make you feel the browser cannot be closed, so that you call the number on screen. In reality, many fake pop-ups are only a full-screen web page with repeated dialog boxes, making you think the machine is locked.

Try closing the browser using the operating system's own method, not any button inside the pop-up. Once the browser is closed, if the warning disappears and files and other programs are all normal, a fake pop-up is highly likely. When reopening the browser, do not restore the previous tabs, or the fake pop-up will very likely come back.

Check 4: Can the sender produce real evidence?

Extortion emails often contain a frightening claim, for example that someone has recorded your screen or taken your contact list. But making a frightening claim is not the same as being able to do it.

The question to ask is: is the information the sender mentions something that only someone who broke into your machine would know? Take the most common example: the email includes an old password you once used. Many people see their own old password and immediately believe someone has broken in. But that old password very likely came from a data breach at some website years ago, and has been circulating online ever since. The sender does not need to break into your machine to get it. An old password does not mean someone controls your machine right now.

By contrast, if the sender can mention information you only wrote down recently and that has never appeared online, that is a signal to take seriously. When you cannot tell, treat it as a risk: keep the email, check your accounts, do not dismiss it as nothing, and do not pay straight away.

Check 5: Look at the other signs together

One sign alone is not enough. Look at the whole set:

If most of the five checks point to real encryption, treat it as real encryption. If most point to a fake warning, you can handle it as a fake warning, but still do the follow-up checks described below.

Real encryption: stop, and follow the existing sequence

If the checks confirm real encryption, this article will not teach the steps one by one, because this site already has a complete first-response guide and a recovery guide. Only the direction is given here, so that you do not spend too long on this page:

1. Stop. Do not open more files, do not try different decryption tools, do not delete encrypted files.

2. Isolate the machine. Disconnect it from the network so the problem does not spread to other devices.

3. Photograph the ransom screen and note the time you found it. Keep the encrypted files as records.

4. Follow the first-response guide (https://www.computerking.hk/en/blog/ransomware-response-hk-guide/) in order. For the recovery stage, follow the recovery guide (https://www.computerking.hk/en/blog/ransomware-recovery-roadmap/).

The question of whether to pay a ransom is covered in detail in the first-response guide: paying does not mean the files will come back, and it is not expanded here. For charges, all inspection and recovery services are quoted individually, and there is no flat price.

Fake pop-ups: how to close them safely

Once a fake browser pop-up is confirmed, the sequence is:

1. Do not click anything inside the pop-up. That includes its close button, update button and scan button. Any button in it can be a trap.

2. Do not call the number on the pop-up. That number is not any official support line. Calling it will very likely lead to being told to install remote-control software, or to pay for a so-called unlocking service.

3. Do not let anyone take remote control of your machine. No legitimate support process asks you to hand over remote control through a pop-up phone call.

4. Close the browser from the operating system. Use the system's own program management tool to end the browser. When reopening it, do not restore the previous tabs.

5. Do three follow-up checks: first, check the browser's notification permissions and remove permission from any site you do not recognise; second, check whether the browser has gained an extension you do not recognise, and remove it if so; third, run a full scan to confirm there is nothing else abnormal on the system.

After these steps, if all files are normal and the system shows nothing else abnormal, the incident can be treated as a closed fake warning. But remember one turning point: if files still will not open after the browser is closed, switch immediately back to the real-encryption direction, and stop treating it as a fake warning.

Extortion emails: how to handle them

Extortion emails follow similar principles to fake pop-ups, with email handling added:

1. Do not reply, do not click links, do not open attachments, do not pay. Replying alone tells the sender that this email address is in use, and will only bring more emails of the same kind.

2. Do not delete the email yet. Keep the original email as a record. If you later need to make enquiries with a relevant body or report the matter, the email itself is part of the evidence.

3. Check the sender and the contents. See whether the sender address matches the organisation it claims to be, and whether the contents mention recent private information or only vague threats plus an old password. Use the method in check 4 above for this judgement.

4. Check important accounts. If an old password mentioned in the email is still in use on other services, change it on a clean device and turn on two-factor authentication. Do not change passwords on a device you suspect is affected.

5. Consider reporting. If the incident involves a risk of personal data leakage, an organisation can refer to the Hong Kong Privacy Commissioner for Personal Data's data breach handling guidance and consider whether reporting and follow-up are needed. The reporting decision must be judged on the actual situation, not on a feeling that there is nothing wrong.

The five most common mistakes

Everyday habits that reduce fake warnings: three of them

Fake warnings are not avoided by luck. Three habits reduce how often they appear:

1. Tighten browser notification permissions. Only let sites you recognise, and that genuinely need to send instant notifications, send them. Do not grant permission to sites you do not recognise. Many fake pop-ups arrive through notification permission, and tightening this one setting already blocks a large class of fake warnings.

2. Install software only from official sources. Do not install so-called cleaning tools or unlocking tools from pop-ups, message links or download sites you do not recognise. Tools of this kind are themselves a common way in.

3. Keep backups offline, and test restores. This does not directly block fake warnings, but it gives you options when facing real encryption. For how to build a backup strategy that counts as a real backup, see this site's backup strategy guide (https://www.computerking.hk/en/blog/backup-strategy-hk/). For how to verify that a backup can actually be restored, see the restore verification guide (https://www.computerking.hk/en/blog/backup-strategy-verify-restore-guide/).

All three habits are done in advance, not thought of after an incident. Done in advance, they give you the confidence to tell warnings apart when one appears.

Before asking for help: three pieces of evidence for telling apart

If you cannot tell real from fake, or you want someone to confirm after doing the checks, prepare these three items so the other side can judge faster:

1. A full photo of the pop-up or email. Photograph the whole screen. Do not crop out the browser address bar or the email sender, because those two positions are themselves clues for telling apart.

2. The names and extensions of a few affected files. Being able to say which files will not open, and what their extensions changed to, is what separates real encryption from an individual file problem. Do not send the files themselves before this is confirmed.

3. When it was found, which machine, and what was clicked. Include the time found, which device, whether any pop-up button was clicked, and whether any email attachment or link was opened. These details decide the scope of what needs checking next.

Preparing these three items saves back-and-forth questions, and avoids a wrong judgement made with incomplete information. For charges, inspection services are quoted individually.

Summary

When a message says "your files are encrypted", the first step is not to pay, and not to call. It is to tell apart. Do all five checks: whether files open, where the message appears, whether the browser can be closed, whether the sender has real evidence, and the other signs together. Real encryption means stop and isolate, and follow this site's first-response guide. A fake pop-up means do not click, do not call the number on screen, do not hand over remote control, close the browser from the operating system, and do the follow-up checks. An extortion email means do not reply, do not click, do not pay, keep the email and check your accounts.

Telling apart is what stops a fake warning from scaring you into a wrong decision, and stops real encryption from being treated as a small matter. Tighten browser notifications in advance, install software only from official sources, and keep offline backups with tested restores. The next time a similar warning appears, you will be much more sure of yourself.

FAQ

Q: The pop-up says my files are encrypted, but the files still open. Is it fake?

A: It points to a fake warning. Files under real encryption will not open. If files open and their contents are normal, the files themselves are not encrypted, and the warning is only a web page inside the browser. Handle it as a fake pop-up: do not click anything inside it, end the browser from the operating system, do not restore the previous tabs when reopening, and then check notification permissions and extensions.

Q: The pop-up will not close. Does that mean my machine is already controlled?

A: Not necessarily. Many fake pop-ups only use a full-screen web page with repeated dialog boxes, making you think they cannot be closed. Try ending the browser with the operating system's own program management tool. That usually closes it. If the warning disappears after the browser is closed, and files and other programs are normal, a fake pop-up is highly likely.

Q: An extortion email mentions my old password. Does that mean someone has broken into my machine?

A: Not necessarily. An old password very likely came from a data breach at some website years ago, and has been circulating online ever since. The sender does not need to break into your machine to get it. An old password does not mean someone controls your machine right now. Still, if that old password is still in use on other services, change it on a clean device and turn on two-factor authentication.

Q: What happens if I call the number shown in a fake pop-up?

A: Do not call it. That number is not any official support line. Calling it will very likely lead to being told to install remote-control software, or to pay for a so-called unlocking service. Once remote control is handed over, the other side can do anything on your machine, and the loss can be far larger than the fake pop-up itself.

Q: I already clicked a button inside the pop-up. What do I do now?

A: Stop immediately. Do not follow any further instructions from the pop-up, including not installing any software, not handing over remote control, and not entering any account passwords. Then end the browser from the operating system, run a full scan, and check for programs or extensions you do not recognise. If unfamiliar software was installed, or remote control was already handed over, treat it as a break-in risk, and change important account passwords on a clean device.

Q: I already replied to an extortion email. What do I do now?

A: Replying once does not by itself mean there is already a loss, but stop there. Do not reply again, do not click any links or attachments in later emails from the sender, and do not pay. Keep the whole email exchange as a record, check important accounts for abnormal sign-in records, and if there is doubt, change passwords on a clean device and turn on two-factor authentication.

Q: How do I tell whether an email sender is impersonating someone?

A: Look at the full sender address, not just the display name. Impersonation emails often use a similar-looking domain, for example with a letter replaced by a number or an extra word added, so that it looks genuine at a glance. Also, if the contents are only vague threats with no recent private information, impersonation or extortion is more likely. When in doubt, do not go through any link in the email. Open a browser yourself and go to the official site to check.

Q: I cannot tell real from fake. What is the safest way to act?

A: Take the most cautious path: stop first. Do not open more files, do not click pop-up buttons, do not reply to the email, do not pay. Then do all five checks above, and photograph the screen for your records. If you still cannot tell after the checks, treat it as a risk: isolate the machine, prepare the three pieces of evidence, and ask someone to confirm. Taking the cautious path when unsure only costs a little time. Going the wrong way can cost far more.

Sources

• Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT), "Beware of Crypto Ransomware": isolate the infected computer, restore from backup, keep an offline backup copy. https://www.hkcert.org/blog/beware-of-crypto-ransomware
• Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT), "HKCERT Urges Users of Remote Access Tools and NAS Devices to Beware of Ransomware Attacks": change passwords regularly and use multi-factor authentication, disable unused accounts, maintain offline backups and test restoration regularly. https://www.hkcert.org/blog/hkcert-urges-users-of-remote-access-tools-and-nas-devices-to-beware-of-ransomware-attacks
• Hong Kong information security site, "Protect Yourself against Ransomware": back up regularly and keep backup copies disconnected from the computer, install the latest patches, do not open attachments and links in suspicious emails. http://www.cybersecurity.hk/en/learning-ransomware.php
• This site's first-response guide, "Ransomware Response Guide for Hong Kong SMEs: First Steps & Recovery": https://www.computerking.hk/en/blog/ransomware-response-hk-guide/
• This site's recovery guide, "After a Ransomware Attack, How Do You Get Back to Work? Restore or Reinstall, Resetting Passwords, and What to Check Before Reconnecting": https://www.computerking.hk/en/blog/ransomware-recovery-roadmap/
• This site's backup strategy guide, "Hong Kong Backup Strategy Guide: The 3-2-1 Rule Done Properly — Time Machine, Windows, Cloud and Offline Drives": https://www.computerking.hk/en/blog/backup-strategy-hk/