Push-notification spam: how sites get permission and how to take it back

What push-notification spam is

Browsers let websites send short messages to your desktop, the same way a mail or chat site tells you about a new message. The site has to ask first, and the browser shows a prompt with Allow and Block. Once allowed, the site can send messages whenever it wants, until the permission is removed.

Notification spam is the abuse of that feature. A site collects as many Allow clicks as it can, usually with a misleading reason, and then sends advertising: fake virus warnings, "your subscription has expired" alerts, prizes, dating offers, crypto schemes and adult content. Each click on a message earns the sender money and leads to more scam pages.

It is a form of adware, but with one important difference: no program and no extension is installed. The permission is a single entry in the browser's settings. That is why antivirus scans often find nothing, and why the fix is in the browser.

How the messages reach your desktop

When you allow notifications, the site registers a small background script in the browser, called a service worker, and subscribes to the browser's push service. Chrome, Edge and Firefox each run their own push service. From then on, the site's server can send a message to that subscription at any time.

The browser receives the message and hands it to Windows, which shows it as a normal toast notification in the corner of the screen and keeps it in the notification centre. The toast names the browser and the site's address. This is why the messages look like system alerts and why they appear even when the site is closed.

The browser still has to be running for the message to arrive, but Chrome and Edge often keep a background process open after the last window closes. Turning off notifications for the whole browser in Settings > System > Notifications silences everything from that browser, including sites you want. Removing the permission for the spam sites is the precise fix.

Because the subscription lives in the browser profile, it does not move between browsers. A site allowed in Chrome cannot send messages through Edge. Browser sync, however, can copy site permissions to other computers signed in to the same account.

The tricks sites use to get an Allow click

Nobody wants a stream of fake virus alerts, so spam sites never say what the permission is for. They put a reason on the page that makes Allow look like a step you must take. Common versions:

• A fake CAPTCHA: "Click Allow to confirm you are not a robot", sometimes with a picture of a robot and an arrow pointing at the prompt.
• A fake video player: "Press Allow to watch the video" over a blurred frame.
• A fake download: "Your file is ready. Click Allow to download."
• An age check: "If you are 18 or older, click Allow."
• A fake error: "Allow to continue" or "Allow to close this window".
• A prize or survey page that asks for permission to "send your reward".

Visitors rarely type these addresses. They arrive through a redirect from a streaming, file-hosting or adult site, from a pop-under ad, or from a link in another notification. The domains change often: when one is blocked, the same operators register new ones with random-looking names.

A real CAPTCHA never asks for notification permission, and no video player or download needs it. Any page that tells you to click Allow to continue is asking for the right to message you later.

How to recognise notification spam on Windows

• Messages slide in from the bottom-right corner of the screen, above the clock, even when the browser is minimised.
• The message shows the browser's name, such as Google Chrome or Microsoft Edge, and an unfamiliar web address.
• The text imitates security warnings ("Your PC is infected with 5 viruses"), antivirus renewal notices, prizes or dating messages.
• The messages continue after an antivirus scan that found nothing.
• The notification centre, opened by clicking the date and time, holds a long list of the same messages.

If a pop-up has no website address and looks like a program's own window, it is not a browser notification. Look for an ad-supported or fake security program in Installed apps instead.

Real Windows Security alert or spam notification?

Spam notifications copy the look and wording of security alerts, so it helps to know what the real ones look like.

• A real alert from Microsoft Defender names Windows Security as its sender at the top of the toast. A spam message names a browser, such as Google Chrome or Microsoft Edge, and shows a web address.
• A real alert opens the Windows Security app when clicked. A spam message opens a web page.
• Real alerts never contain a phone number, a countdown, a price or a renewal offer.
• Real alerts describe one detected file and what was done with it, such as quarantined or removed. Spam messages give round, frightening numbers of "viruses" without file names.
• Real alerts are listed afterwards in Windows Security > Virus & threat protection > Protection history. Spam messages are not.

When in doubt, do not click the message. Open Windows Security from the Start menu instead and look at its status. If it shows no actions needed, the message was spam.

Is notification spam dangerous?

The notification itself cannot do anything to the PC. It is a short text with an image and a link. It cannot read your files, install software or see what you do in other tabs.

The risk is in the pages the messages open. They lead to fake virus scans that push you to buy security software, tech support scam pages with a phone number, fake browser updates that download malware, fake CAPTCHA pages that ask you to paste a command into Windows, and prize pages that collect card details. Because the messages look like Windows alerts, people trust them more than ordinary ads.

Some notification messages lead to the checkout of a real antivirus brand through a commission link. The warning that sent you there was still fake. Real security software reports problems in its own window, not through a website's notification.

So the answer is: the permission is harmless on its own, but the traffic it delivers is aimed at people who might call, pay or download. Remove it, and do not click the messages while they are still arriving.

How to take the permission back

Removing notification permission takes a minute per browser. The exact clicks for Chrome, Edge and Firefox on Windows are in Stop website notifications and pop-ups. In short, each browser keeps a list of sites that are allowed to send notifications; remove every site you do not recognise, and block it so it cannot ask again.

Some practical points that save a second round:

• Clean every browser you use. A permission in Chrome does nothing in Edge, and the reverse.
• Remove all unknown sites, not just the one in today's message. Spam sites often come in groups allowed within minutes of each other.
• If you use browser sync, make the change while signed in, so other computers receive the removal instead of syncing the permission back.
• Clear notifications that are already in the Windows notification centre so you do not click an old one by mistake.
• If you prefer not to see notification prompts at all, each browser can block all sites from asking. Chrome also offers quieter prompts that show only a small icon in the address bar, and Edge has a similar quiet requests option.

If messages keep arriving after the permission is gone, something else is involved. Check the extension list in each browser with Remove a browser extension, and if the browser opens scam pages by itself, reset it with Reset a browser and fix a hijacked search engine.

If you clicked a message or acted on it

Clicking a notification opens a page, nothing more. What matters is what you did on that page.

• You only looked. Close the tab and remove the permission. Nothing was installed.
• You downloaded and ran a file. Disconnect from the internet, run a full scan and then an offline scan: Run a Microsoft Defender Offline scan. Our page on trojans and loaders explains why one file can bring several infections.
• You entered card details. Call your card issuer on the number printed on the card and ask them to block the card. Then follow What to do after paying a scammer.
• You typed a password. Change it from a clean device and turn on two-step verification: Turn on two-step verification / secure a hacked account.
• You called a phone number. Follow our tech support scams page, especially if you let someone connect to the PC.
• You pasted a command into Run, Terminal or PowerShell. Treat the PC as infected with a password stealer; see the fake CAPTCHA and ClickFix page.

How to avoid notification spam

• Click Block on notification prompts from any site you do not know and do not need messages from. When in doubt, block; you can allow a site later from its address bar.
• Treat "click Allow to continue" as a red flag. Close the tab rather than answering the prompt.
• Leave sites that open pop-unders and new tabs on every click; they are the main entry point.
• Keep Safe Browsing on in Chrome and Microsoft Defender SmartScreen on in Edge. Chrome also blocks notifications from sites it rates as abusive, and it can remove notification permission from sites you have not visited recently that send many messages.
• Check the notification list in each browser now and then, as you would check your extensions.
• Keep the browser updated: protections against abusive notification prompts are updated with it.

Common myths

"The pop-ups mean my PC has a virus." They mean a site has permission to message you. The warnings in the messages are invented.

"An antivirus will remove them." There is usually no file to remove. Some security products can clean browser permissions, but the reliable fix is the browser setting.

"Reinstalling the browser fixes it." Reinstalling often keeps the profile, and sync restores the permission. Removing the permission is faster and certain.

"Turning off all Windows notifications is the solution." It hides the messages but also hides alerts you want, including Windows Security's own. Remove the spam sites instead.