Free Mac security scan: what's real and what's a scam

MacUpdated

Your Mac already scans for known malware, using XProtect, the antivirus technology built into macOS. Apple says XProtect checks apps when they first open and when they've changed, and keeps checking periodically for infections. A website or pop-up offering a free Mac security scan is a different thing, and Apple says not to believe pop-ups that warn of viruses on your device.

Quick answer

macOS includes XProtect, which Apple describes as built-in antivirus. It checks apps at first launch and when they change, and removes known malware. Apple says not to believe browser pop-ups warning of viruses on your device: close the tab, don't call the number. Real macOS malware alerts appear when you open an app, not on a web page.

Does a Mac scan itself for viruses?

Yes. Apple says macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware. In macOS 10.15 or later, XProtect checks for known malicious content when an app is first launched, when an app has been changed and when its signatures are updated. Apple updates those signatures automatically, and by default macOS checks for updates daily.

If malware does get onto a Mac, Apple says XProtect has an engine that removes it when updated information arrives, and continues to periodically check for infections. Apple doesn't describe a button to start a scan yourself. More on how it works in what is XProtect on Mac.

Are online "free Mac scan" pop-ups real?

Don't believe them. Apple says that if a pop-up or alert warns you about security problems or viruses on your device while you're browsing, don't believe it. These pop-ups are usually fraudulent adverts, designed to trick you into downloading damaging software or giving the scammer personal information or money.

Apple's description of the tactics: some pop-ups use warnings or prizes to make you believe they're from Apple or another trusted company, and others claim to offer free downloads, software updates or plug-ins to get you to install unwanted software. The US Cybersecurity and Infrastructure Security Agency (CISA) gives an example to watch for: a browser alert showing a red stop sign with an urgent message prompting you to click to enable antivirus scanning. CISA says it may be malware.

The US Federal Trade Commission (FTC) adds two rules that hold for any of them. Real security pop-up warnings never ask you to call a phone number. And legitimate tech companies won't contact you by phone, email or text to tell you there's a problem.

How do I get rid of a scan pop-up on a Mac?

Don't click anything inside it. Apple warns that some pop-ups have fake buttons that look like a close button.

  1. Close the whole Safari window or tab, or type a new address in the Search field.
  2. If it keeps coming back, quit Safari, then hold down the Shift key while you open it again. Apple says this stops Safari reopening the windows and tabs that were open.
  3. Don't call any number shown and don't follow its links.

How do I stop scan pop-ups coming back?

Safari has settings for this.

  1. Open Safari, then choose Safari > Settings.
  2. In the Websites tab, block pop-ups for some or all sites.
  3. In the Security tab, turn on the warning for fraudulent websites.
  4. In the Extensions tab, turn off or uninstall any extension you don't need.

Some websites ask to send you notifications. Apple says that if you click Allow, those notifications appear on the Lock Screen and in Notification Centre, so only allow sites you trust.

What if the pop-ups won't go away?

Apple says pop-ups that won't go away can mean you've installed adware or other unwanted software, sometimes bundled by third-party download sites with the software you wanted. Its steps:

  1. Update to the latest version of macOS. If you're already on it, restart your Mac. Apple says macOS includes a built-in tool that removes known malware when restarting.
  2. Check your Applications folder for any apps you don't expect, and delete them.
  3. Check Safari's Extensions tab for extensions you didn't mean to install.

To delete an app, quit it, find it in the Applications folder, and use its own Uninstall or Uninstaller app if it came with one. Otherwise drag it to the Trash. Apple notes that deleting an app doesn't cancel any subscription you bought with it, so cancel that first: in the App Store, click your name at the bottom of the sidebar, click your name again, then Subscriptions, choose the subscription and click Cancel Subscription. For a fuller check of login items and permissions, see how to check your Mac for malware.

What does a real macOS malware warning look like?

It appears when you try to open an app, not while you're browsing. Apple says that if macOS detects that software has malicious content, your Mac tells you the app will damage your computer. Another alert says Apple can't check an app for malicious software; Apple suggests checking the App Store for an updated version or an alternative.

Apple says the safest place to get apps for your Mac is the App Store, and if you need something that isn't there, to get it directly from the developer rather than through an ad or link.

If you already called the number or paid, the next steps are in how to choose Mac security software.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer security for your Mac, for the moment someone sits down at it and unlocks it.

  • While it's on, Failshot photographs whoever unlocks your Mac, then, with Pro, records a 5-second video.
  • With the Mac's built-in camera, the green light comes on, and Failshot's window tells whoever unlocked the Mac that the unlock was photographed.
  • With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.
  • Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Get it from failshot.app for macOS 14 or later. Free to download. It's free to use. Pro adds video, email alerts and the encrypted vault, and you can try Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

More questions

Is there a free virus scan for Mac?

macOS includes XProtect, which Apple describes as built-in antivirus technology. It checks apps automatically at first launch, when they change and when its signatures update. The NCSC says making sure built-in antivirus is switched on makes you instantly safer.

Is the "your Mac is infected" message real?

Not if it appears on a web page. Apple says not to believe pop-ups or alerts that warn about viruses on your device while browsing. Real macOS warnings appear when you try to open an app.

Can a website scan my Mac?

Apple doesn't describe any website that can, and says browser pop-ups offering to fix security problems are usually fraudulent adverts. Close the tab, and get any software from the App Store or the developer's own website.

Should I download a Mac cleaner a pop-up recommends?

No. Apple says these pop-ups are designed to trick you into downloading damaging software. Its advice is to install software from the App Store or directly from the developer, never through an ad or link.

Does restarting my Mac remove malware?

Apple says macOS includes a built-in tool that removes known malware when restarting, which is why it suggests updating macOS, or restarting if you're already up to date, when pop-ups won't go away.

Sources