Microsoft has started testing a new “scareware blocker” feature for the Edge web browser on Windows PCs, which uses machine learning (ML) to detect tech support scams.

Scareware scams (also known as tech support scams) have been a pervasive threat for years. The scammers use aggressive landing pages to persuade potential victims that their devices have been compromised with malware and then try to gain remote access to targets’ systems by pressuring them to call a fake tech support number.

Defender SmartScreen, which also protects Edge users from scams, activates after an abusive site is detected and added to its index of malicious web pages to safeguard users globally within minutes.

However, Microsoft’s new Edge scareware blocker, introduced at the 2024 Ignite conference, offers extra protection by detecting signs of scareware scams in real-time using a local machine learning model.

“Scareware blocker adds a new, first line of defense to help protect the users exposed to a new scam if it attempts to open a full screen page. Scareware blocker uses a machine learning model that runs on the local computer,” Microsoft said.

“The model uses computer vision to compare full screen pages to thousands of sample scams that the scam-fighting community shared with us. The model runs locally, without saving or sending images to the cloud.”

Once it detects a scam page, it alerts users and allows them to continue loading the webpage if they trust the site is safe.

​”To enable in Edge, first make sure that previews are allowed by your administrator and also that Edge is fully up to date. You may want to restart the browser once more to make sure your Edge client has the preview,” Microsoft added on Monday.

“After making sure you have the latest updates, you should see the scareware blocker preview listed under “Privacy Search and Services.'”

When the scareware blocker spots a potentially malicious page, Edge gives control back to the user, exiting full-screen mode, halting loud audio, displaying a warning, and showing a thumbnail of the page.

Users can then report the scam site to protect others by sharing screenshots and diagnostic info with Microsoft, helping the Defender SmartScreen service detect scareware outbreaks across users’ devices.

The scareware blocker ML model will discard the page if users don’t report the page. To reduce false positives, users should also report cases where legitimate sites are flagged as malicious.

“By reporting false alarms, you help us make the feature more reliable to catch the real scams. Beyond just blocking individual scam outbreaks, our Microsoft Digital Crimes Unit goes even further to target the cybercrime supply chain directly,” Microsoft said.

On Friday, the company also reminded customers that a new brand impersonation protection feature for Teams Chat will be generally available by mid-February 2025.