Antivirus folklore travels fast. We separate the common beliefs from what federal consumer guidance actually says, from device myths to fake renewal warnings.
Antivirus advice gets handed down like folklore: Macs don’t get viruses, the paid version is always safer, and any pop-up that knows the name of your security software must come from that software. Federal consumer guidance from the FTC cuts against most of it. Here are five beliefs worth retiring, and what the sources actually support.
Myth: Macs and iPhones Don’t Need Security Software
The belief is easy to understand, but the FTC’s guidance on malware makes no exception for any brand or operating system. The agency ranks malware among the biggest threats to computers, tablets, phones, and other devices, period. Criminals dangle attractive websites, tempting downloads, and convincing stories to get people onto links that install malware, and the FTC notes the trick works especially well on machines that lack solid security software.
The practical steps look the same no matter which company made the device: security software that updates on its own, an operating system and browser set to update on their own, and skepticism about what you download. Assuming immunity has its own cost, too. Someone who believes a device cannot be infected is more likely to ignore the warning signs the FTC lists, like a browser home page that changes on its own or pop-ups that keep multiplying.
Myth: Free Protection Is Useless or Paid Is Always Better
The FTC’s advice never prices protection. What it says is to install security software from a reliable company, keep it current, and set it to scan new files on its own. For picking an option, the agency suggests checking independent review sites and asking friends and family what they use.
The real risks come from how software is obtained, not its price tag. Free downloads can hide malware. Ads touting security software can be malware wearing a security label, which is why the FTC says not to buy anything in response to unexpected calls or messages. The agency has pursued these schemes in court, including a case against a marketer of fake security warnings that ended in a $163 million judgment in 2012. A paid subscription bought under pressure from a stranger is worth less than a free tool from a company you vetted.
Myth: Once Antivirus Is Installed, Nothing Gets Through
Security software is a layer, not a force field. The FTC acknowledges that infections can slip past even up-to-date protection, at least for a while, and that careful habits are no guarantee either: malware can still land on a machine that has it. Some newer tricks skip the traditional delivery method entirely. In a scheme the FTC is getting reports about, a fake CAPTCHA screen instructs you to punch in a chain of keystrokes, something like Windows + R, then Ctrl + V, then Enter. The screen says security verification, but you are actually pasting and running hidden malware yourself. Legitimate CAPTCHAs only hand you puzzles to solve; they never ask you to run commands on your own machine.
That is why the habits around the software matter as much as the software. Do not click links in unexpected emails. Do not click ads to download software; type the company’s address into your browser instead. If something suspicious lands anyway, run a security scan, change your passwords, and turn on two-factor authentication from a different device.
Myth: Antivirus Renewal Pop-Ups Are Always From Your Own Software
A renewal notice that names your security product feels authentic. Scammers count on that. The FTC warns against buying security software in response to unexpected calls or messages, especially any that claim to have scanned your computer and found malware. It also says not to dial any number shown inside a pop-up, since a pop-up telling you to reach tech support is a scam and no honest tech company calls or texts out of nowhere to report computer trouble. We walk through the full playbook in how tech support scams work and how to shut them down.
The scheme has grown more aggressive. The FTC has described a version where the pop-up announces that accounts holding your bank, investment, or retirement money have been compromised, then patches you through to a caller posing as a federal agency or as the fraud team at your bank. That stranger pushes you to move funds into a “new account,” buy gift cards or bitcoin, or withdraw cash or gold and hand it over. If you are unsure whether a renewal is real, ignore the pop-up and contact the company using the website or phone number you already have. And if a charge went through for something you did not want, the FTC’s rules on canceling online subscriptions explain what companies must do when you cancel.
Watch for
Do not dial any number printed inside a pop-up. The FTC’s position is that genuine security alerts never tell you to phone anyone.
Myth: Antivirus Slows Your Computer to a Crawl
Slowness gets blamed on security software so often that the actual cause can go unchecked. The FTC counts a computer that runs sluggishly, loses its battery charge fast, throws errors or crashes, or balks at shutting down or restarting among the signs of a malware infection, alongside endless pop-ups and pages you never asked for. In other words, the symptom people attribute to their antivirus can be the very thing the antivirus is there to catch.
The agency’s guidance points the other way on performance. After walking through the cleanup steps for a hijacked computer, it ends with making sure the operating system and browser update automatically, because that is what keeps a machine running at its best. If a device is sluggish along with crashes or pop-ups, the FTC advises pausing shopping, banking, and password typing online until it has been cleaned.
What Actually Moves the Needle, Myth-Free
Stripped of folklore, protection comes down to a short list:
- Security software from a reliable company, set to update on its own and scan new files automatically.
- Operating system and browser updates switched on, since updates usually carry fixes for security holes.
- A pop-up blocker, plus a browser security setting strict enough to catch unauthorized downloads (the medium level or higher works as a floor).
- Downloads only from websites you know and trust.
- A security scan of anything removable, from flash drives to portable hard drives, before you open files on it.
- Automatically generated passwords and two-factor authentication, preferably with an authenticator app or security key rather than a text passcode.
- A secured home Wi-Fi network, because an infection that lands on one device there can cross over to everything else connected to it.
None of these depend on whether the software was free, which company made your device, or how loudly a pop-up insists something is wrong.
Security habits overlap with the rest of your online life. Forgotten accounts are one more place for your data to leak out, so it pays to clean up old online accounts before they leak. And for another tool that gets oversold, see our honest look at whether you need a VPN.
The essentials
- The FTC describes malware as a threat to computers, tablets, phones, and other devices, with no exception for any brand or operating system.
- Price does not determine protection; what matters is software from a reliable company that updates and scans new files automatically.
- The FTC cautions that security software can miss infections, at least for a while, so protection is a layer rather than a guarantee.
- The FTC warns against dialing a number shown in a pop-up or buying software after an unexpected call or message; both are scammer tactics.
- A slow, crash-prone computer is listed by the FTC as a possible sign of malware infection, not a normal side effect of security software.
Reader questions
Do I need to buy a paid antivirus subscription?
The FTC’s guidance focuses on using security software from a reliable company that updates automatically, not on price. Check independent review sites and ask people you trust before choosing.
What should I do if a pop-up tells me to call tech support?
Do not call it. The FTC treats any pop-up urging you to phone tech support as a scam, and genuine security alerts never ask you to call anyone.
Can a fake CAPTCHA install malware?
Yes. The FTC is getting reports about fake CAPTCHA screens that ask you to type commands like Windows + R and Ctrl + V, which pastes and runs hidden malware. Legitimate CAPTCHAs only give you puzzles; they never ask you to run commands on your machine.
What if my computer starts acting strangely?
Hold off on shopping, banking, and typing passwords online until the device is clean. The FTC advises installing or updating security software from a reputable company, running a scan, then changing the passwords on your important accounts.
We describe how services generally work; features, settings and terms change often, and they differ between companies. This is general information, not legal advice. Check the provider’s current policies and official sources such as FTC.gov.