Tech support scams: fake warnings, phone numbers and remote access

What a tech support scam is

Tech support scams are run by call centres whose staff pretend to work for Microsoft, Apple, an antivirus company, an internet provider or a bank's fraud team. The aim is always the same: convince you that something is wrong with your computer or account, get control of the PC through a remote access program, and take money.

The scam is large and growing. In its 2025 annual report, the FBI's Internet Crime Complaint Center (IC3) recorded 47,794 complaints in its Tech/Customer Support category, with reported losses of about $2.13 billion, up from 36,002 complaints and about $1.46 billion in the 2024 report's Tech Support category. Those are only the cases reported in the United States.

Nothing about the scam requires malware. It works through fear, urgency and trust in big brands. That is why antivirus software often cannot stop it, and why knowing the pattern is the best protection.

How the scam reaches you

A fake warning in the browser

The most common start. A web page opens in full screen and copies the look of a Windows or Microsoft Defender warning. It may play a recorded voice, show a fake scan, claim that your passwords and bank details are being stolen, and say "Do not restart your computer". A phone number for "Microsoft support" sits in the middle. Scripts make the page hard to close: the mouse pointer disappears, the window keeps asking for confirmation, or the address bar is hidden.

These pages arrive through malicious ads, mistyped web addresses, redirect chains and notification spam. None of this means the PC is infected; the browser is showing a web page.

A fake alert from an installed program

Some fake security programs show the same kind of warning from the desktop, with the browser closed. Here something is installed, but it is the fake alert program itself, not the virus it describes.

An unexpected phone call

A caller says they are from Microsoft, Windows, your internet provider or your bank, and that your computer is sending errors or has been hacked. Microsoft does not make unsolicited calls to offer technical support.

A fake invoice or renewal e-mail

A message confirms a purchase or a subscription renewal you did not make, often for antivirus or a support plan, with a phone number "to cancel or dispute the charge". It contains no link to click, only the number. Some versions are real invoices sent through genuine billing services from accounts the scammers opened. Our page on phishing e-mails covers these messages.

Search ads and fake support listings

People who search for a company's support number can land on a scammers' ad or a fake listing. Always take support numbers from the company's own website or from the product itself.

What happens on the call

The script is well practised and follows a fairly fixed path:

1. Urgency. The "technician" confirms the alarm and says your data, bank account or identity is at risk right now.
2. Remote access. You are asked to install a remote access program or open one already on the PC, then read out a code. Commonly used tools include AnyDesk, TeamViewer, ScreenConnect, UltraViewer, LogMeIn and Windows' own Quick Assist. These are legitimate programs; the scam is in who is on the other end.
3. Fake proof. The caller opens normal Windows tools such as Event Viewer, a list of running processes or a command window and presents ordinary warnings and files as evidence of hacking. Some type alarming text into a command window themselves.
4. The sale. You are offered a repair, a "lifetime" support plan or a security product, usually for a few hundred dollars or euros.
5. The escalation. In the more damaging versions, the caller claims a refund is due, asks you to log in to online banking "to receive it", hides the screen and moves money between your own accounts so it looks like an overpayment. You are then pressured to send the "extra" back by bank transfer, gift cards, cryptocurrency or cash.

Several warning signs appear on almost every call: a request to install remote access software, a request to log in to your bank while they are connected, payment by gift card, crypto, wire transfer or courier, and pressure not to tell anyone, including your bank. Any one of them means you should hang up.

How to tell a real warning from a scam

• Real error and warning messages from Microsoft never include a phone number.
• Microsoft does not call or e-mail you to offer technical support unless you asked for it first.
• Real security alerts come from Windows Security or your installed antivirus, not from a full-screen web page with a countdown or a recorded voice.
• No legitimate company asks to be paid in gift cards or cryptocurrency.
• A website cannot scan your PC, see your files or know whether you have a virus.
• Real support does not need you to log in to online banking while connected to your computer.

If a warning frightens you, do not use anything on it. Close the page, then open Windows Security from the Start menu and check its status yourself.

How to close a fake warning page

Fake warning pages look locked, but they are only a browser tab. Closing them by force is safe and loses nothing.

1. Press Esc to leave full-screen mode, then close the tab.
2. If the browser does not respond, press Ctrl + Shift + Esc to open Task Manager, select the browser and click End task.
3. When you open the browser again, do not restore the previous session.
4. If the page came from notifications, take that permission back: Stop website notifications and pop-ups.
5. If the page opens by itself, check extensions and reset the browser: Remove a browser extension, Reset a browser and fix a hijacked search engine.

Restarting the PC also works and does not harm anything, whatever the page says.

If you called or let them connect

What you need to do depends on how far the call went. Do the money steps first: they are the only ones where minutes matter.

You paid or gave bank or card details

Call your bank or card issuer immediately, using the number on your card or the bank's website, not one the caller gave you. Ask them to stop or reverse the payment and to block the card. Gift card and crypto payments are harder to reverse but still worth reporting to the card company or exchange at once. The steps for each payment method are in What to do after paying a scammer.

You let them connect to the PC

1. Disconnect the PC from the internet: unplug the cable or turn off Wi-Fi.
2. Uninstall the remote access program they used from Settings > Apps > Installed apps. Look for other remote tools installed the same day as well: Uninstall a program or app in Windows On uGetFix.
3. Check Task Manager > Startup apps and Task Scheduler for entries added during the call.
4. Run a full scan and a Microsoft Defender offline scan: Run a Microsoft Defender Offline scan. Scammers sometimes leave remote access trojans or password stealers behind.
5. From a different, clean device, change the passwords of your e-mail, bank and any account you used or that was open during the call, and turn on two-step verification. Our page on securing accounts after malware gives the order.

If you are unsure what they changed, a Windows reset that keeps your files removes anything they installed: Reinstall Windows without losing files On uGetFix. Our page on whether to clean or reset Windows helps decide.

They have your personal details

If you gave your Social Security number, ID document or date of birth, watch for identity theft. In the US, a credit freeze stops new accounts being opened in your name: Freeze your credit after a breach.

You only talked to them

If you did not install anything, pay or share details, hang up and do not call back. Block the number. No further action on the PC is needed.

Refund and recovery scams that follow

Victims of tech support scams are often targeted again. The same operators, or others who bought their lists, come back with a new story:

• A call or e-mail saying the support company is closing and owes you a refund.
• A "refund department" that needs remote access to deposit the money, then shows a fake overpayment and asks you to send back the difference.
• Someone posing as a police officer, bank fraud team or government agency who says they caught the scammers and can return your money for a fee.
• A "recovery" company, often advertising online, that promises to get lost money or crypto back in exchange for an upfront payment.

All of them end with you paying again. The FTC's rule of thumb is simple: never pay upfront for help getting a refund, and never give account details to someone who contacts you about one. Real refunds come through your bank, card issuer or payment service, or from official programmes run by agencies such as the FTC, which never ask for a fee. The IC3 also warns that it does not work with private firms to recover funds and never contacts victims to ask for money.

Report the scam

Reports give you a reference number for your bank and help police link cases. Include the phone number, the web address of the warning page, the remote access tool used, and payment details.

• United States: FBI IC3 at ic3.gov and the FTC at ReportFraud.ftc.gov.
• United Kingdom: Report Fraud at reportfraud.police.uk.
• Canada: the Canadian Anti-Fraud Centre.
• Australia: ReportCyber and Scamwatch.
• EU: your national police, through Europol's list of reporting sites.

The full list with links is on our page on where to report cybercrime, and the steps are in Report a cyber attack or scam to the authorities. Microsoft also takes reports of scams that impersonate it through its technical support scam form.

How to protect yourself and others

• Remember the two rules: Microsoft warnings never contain phone numbers, and Microsoft does not call you unless you asked it to.
• Never let anyone connect to your PC unless you contacted them first through a number you looked up yourself.
• Take support numbers only from the company's own website, the product's help menu or your printed documents, not from search ads.
• Keep the browser updated and Safe Browsing (Chrome) or SmartScreen (Edge) on.
• Click Block on notification prompts from unknown sites.
• If an older relative uses the PC, tell them about these scams in advance. In IC3's 2025 report, people over 60 filed the most complaints and reported the largest losses of any age group.