I am convinced, by many real world observations, that the average joe user cannot distinguish fake html/css/js popups from OS popups.
Case in point, countless relatives calling "I have a virus on my computer!" because they have a Windows-XP popup on a website "you have a virus" (they are on Windows 10, or Mac OS).