The $149.99 pop-up copies Apple's design system, which makes it support's problem

The dialog does not have to be perfect, because it is not the only thing on the screen. Malwarebytes describes pop-ups with transparent backgrounds sitting over what looks like Apple's or Amazon's real site, usually a screenshot or a cloned page ^[4]. The forgery in the foreground borrows its credibility from the layout behind it, and that layout belongs to the brand. On the Apple decoys the dialog itself carries rounded corners and blue buttons ^[3], which are the parts of a design system a company spends years making recognisable at a glance.

So the advice on offer is not about looking harder. The tells Malwarebytes gives are that Apple and Amazon do not raise account or payment problems through a browser pop-up, using email, in-app notifications or an activity log entry in the account instead ^[9], and that neither company tells a customer to ring a number ^[10]. Those are facts about how two companies operate. Someone who does not already hold them has nothing left to inspect. The third tell, warnings that failing to act will leave you financially or legally liable ^[11], is the only one a stranger can judge cold, and it is also the cheapest thing for an attacker to tone down.

The amount is chosen the way retail chooses amounts. Malwarebytes notes that $149.99 reads as credible for a product on Amazon or a yearly App Store subscription ^[7], and it sits one cent under $150 ^[16], the charm price a real merchant would have picked. Whoever wrote this has looked at the invoices they are imitating.

Reach is what makes the channel question expensive rather than academic. The campaign is built on the near-certainty that anyone who sees the pop-up holds an account with at least one of the two companies ^[14], which buys the notice a few seconds of attention that nothing about it has earned. A brand can document its notification policy in a dozen help pages and still spend those seconds being impersonated, then spend more of them on the phone with customers asking whether a dialog it never sent was genuine.

That second cost is the one product teams actually control, and it is not user education. It is whether your own urgent billing messages ever appear in a channel you have told customers you never use, because every time they do, the reflex being trained is the one this scam rents. It is whether the support script starts from the assumption that the caller has already read a convincing forgery of your interface and may have already read a phone number out of it. What is being copied here is consistency, and consistency is not a feature a brand can switch off for a quarter while a campaign passes.