What to Do When a Browser Hijacker Sends You to Scam Surveys

A browser hijacker can quietly change your search engine, homepage, new-tab settings or DNS behaviour before sending you to fake surveys and prize pages. These redirects may claim you have won a gift card, need to verify an account or qualify for a limited-time reward, but their real purpose is often to collect personal details, push unwanted software or capture payment information.

On Australian networks, these pages may imitate familiar names such as Australia Post, myGov, the ATO, Coles, Woolworths or Bunnings. A convincing logo and local spelling do not prove that a promotion is genuine. Treat unexpected redirects as a security warning, especially when they appear repeatedly across different websites.

Recognise the Hijacker’s Warning Signs

A single malicious advert can open a scam page, but repeated redirection usually points to a wider browser or system problem. Common signs include a search provider you did not choose, unfamiliar extensions, altered homepage settings, pop-ups that return after closing them and adverts appearing on normally clean websites.

Scam surveys often use urgency and rewards to keep you engaged. They may say that only a few places remain, ask for a small delivery fee or request your mobile number before showing the results. Australian users should be particularly cautious with pages claiming to offer supermarket vouchers or Australia Post parcel updates, since these themes are widely used in phishing campaigns.

Sign	What it may indicate	Safe response
Search results open at an unfamiliar site	Changed search settings or extension	Remove unknown extensions and restore trusted settings
Repeated survey redirects	Browser hijacker, adware or malicious script	Disconnect briefly and scan the device
Fake prize or parcel message	Phishing or payment fraud	Close the page without entering details
New browser notifications	Permission abuse	Revoke notification access
Download prompt after a survey	Malware or potentially unwanted program	Cancel it and delete the downloaded file

Close the Scam Page Without Engaging

Do not complete the survey, press “allow”, call a displayed support number or download a supposed verification tool. Some pages deliberately make the close button difficult to find. Use the browser’s normal close control, or quit the entire browser if the page keeps opening new tabs.

If the browser is frozen, use Task Manager on Windows or Force Quit on macOS rather than clicking through warnings. Do not copy commands from a pop-up into Terminal, PowerShell or Command Prompt. A legitimate survey does not need administrator access, antivirus removal or remote-control software.

If you entered a password, change it from a clean device and enable multifactor authentication. Contact your bank immediately if you supplied card details. For scams affecting Australians, report the incident to Scamwatch and keep screenshots, messages, transaction records and the suspicious web address as evidence.

Remove Unwanted Browser Changes

Start by checking installed extensions and removing anything unfamiliar, recently added or unrelated to your normal browsing. Review the homepage, default search engine, startup pages and notification permissions. Resetting the browser can remove persistent changes, although saved passwords and other data should be backed up carefully first.

Next, inspect recently installed applications and sort them by installation date. Unwanted adware sometimes arrives bundled with free PDF tools, media players, cracked programs or fake updates. On Windows, review installed apps and run a reputable security scan. On a Mac, check Applications, Login Items and browser profiles for entries you did not create.

A redirect can also follow a drive-by download, particularly after visiting a compromised website. The Mac infection cleanup guide explains how to investigate and clean this type of incident without relying on the suspicious page’s instructions.

Scan the Device and Check the Network

Run a full scan with an updated, reputable antivirus or anti-malware product. Allow the software to quarantine detected browser hijackers, adware, potentially unwanted applications and malicious scheduled tasks. Restart the device and scan again if the redirect returns.

Persistent detections should not be dismissed simply because the browser appears normal. Follow a structured response in persistent antivirus detection steps when a threat reappears after removal. Safe Mode or an offline scan may be needed if malware prevents security tools from working.

Check the router as well if every device on your home NBN or Wi-Fi connection is redirected. Change the router administrator password, install firmware updates and confirm that DNS settings have not been altered. If only one computer is affected, the browser or operating system is the more likely source.

Reduce the Risk of Further Redirects

After cleaning the device, update the operating system, browsers, extensions and security software. Download programs only from official vendor websites or trusted app stores. Avoid pirated software, unofficial streaming pages and “urgent update” advertisements, which are common delivery routes for adware and trojans.

Use separate passwords for email, banking, shopping and government services. A password manager can help, while multifactor authentication limits the damage if a password is exposed. Be careful with links received by SMS, including messages that appear to concern myGov, the ATO, toll accounts or parcel deliveries.

Use these practical safeguards:

• Keep browser notifications blocked unless a trusted website genuinely needs them.
• Check the complete web address before entering login, identity or payment details.
• Back up important documents to a disconnected drive or reputable cloud service.
• Review bank statements and mobile bills for unfamiliar charges after a scam visit.
• Tell family members, including less technical relatives, that unexpected surveys should be closed rather than completed.

If redirects continue after browser resets and malware scans, the device may have a deeper compromise or an altered network configuration. Preserve relevant logs and security reports, avoid using the affected computer for banking and seek qualified technical assistance through a legitimate Australian provider.