Learn how to recognize fake tech support scams, remote access tricks and fake virus pop-ups, and what to do if a scammer accessed your computer.
You are browsing the web when the screen fills with a red alert: "Your computer has been infected with 5 viruses. Call Microsoft Support immediately at 1-800-XXX-XXXX to remove them." A siren plays, a progress bar flashes, and a phone number sits in the middle of the page. Or your phone rings, and a calm voice on the other end says they are from a well-known tech company and have noticed unusual activity on your device. Within a few minutes, they ask you to install a small program so they can "take a look."
These are fake tech support scams, and they rank among the most financially damaging frauds in circulation. The Federal Trade Commission (FTC) describes the pattern in plain terms: scammers try to scare you into believing there is a problem with your computer, then use that fear to get your money or remote access to your device. What they are really after is your money, your login details, or your identity.
This guide walks through how fake tech support scams work, the warning signs worth checking, why remote access is so risky, and exactly what to do if you have already let a scammer in. It focuses on impersonated technical support, fake device warnings, and remote-access abuse, which are distinct from email phishing and suspicious-link scams that we cover elsewhere.
A fake tech support scam is a fraud in which someone pretends to be a legitimate technology provider, whether that is Microsoft, Apple, a well-known antivirus company, or a generic "support" service, in order to convince you that your device has a problem only they can fix. The problem is invented, but the fear it creates is real.
The scammer's goal is rarely to repair anything. They are usually after one or more of the following: remote access to your computer, your passwords or one-time codes, your payment details, or a direct payment for "support" you do not need. Microsoft is clear that it will never proactively reach out to offer unsolicited PC or technical support, and that genuine Microsoft error messages never include a phone number to call.
Legitimate remote support does exist. A real technician you contacted through a company's official website may use remote-access software to help you, but only after you started the request and confirmed who you are dealing with. What separates real from fake is who initiated the contact and whether you can independently verify that the support is genuine. Unsolicited contact is the defining feature of the scam.
The attack tends to follow a predictable sequence, and understanding each stage makes the warning signs much easier to spot.
Everything starts with a manufactured crisis. It might be a full-screen pop-up claiming your computer is infected, a phone call warning of "suspicious activity," or a search result that looks like a support page but is actually run by scammers. The message is built to trigger an immediate threat response, so you stop evaluating and start reacting.
The scammer borrows the credibility of a brand you recognise. Pop-ups copy Microsoft's or Apple's logos and colours. Callers claim to be from "Windows Support," "Apple Security," or a well-known antivirus vendor. Some even spoof caller ID so your phone displays a number that looks official. As Microsoft Learn notes, scammers can spoof caller ID to display a legitimate-looking support number from a trusted company.
The pop-up displays a phone number and urges you to call. If you are already on the phone, the caller asks you to install a remote-access tool, often a legitimate program such as AnyDesk, TeamViewer, or something similar, so they can "diagnose" the problem. The software itself is not inherently malicious; the danger lies in who is using it and why.
Once connected, the scammer runs a few commands and points to normal system output as evidence of infection. A list of harmless files, an Event Viewer full of routine warnings, or a fake "scan" progress bar are all presented as proof that your device is compromised. Microsoft Learn warns that with remote access, experienced scammers can misrepresent normal system output as signs of problems.
The scammer offers to "fix" the invented problem for a fee, asks for payment details, requests passwords or verification codes, or quietly copies files from your device. The FTC notes that scammers often insist on payment through gift cards, wire transfers, bank transfers, cryptocurrency, or payment apps, methods that are hard to reverse and act like cash.
No single sign on its own proves a scam, but several together make a strong case. Always verify the contact independently before taking action.
If someone calls you out of the blue to say your computer has a virus, it is almost certainly a scam. Microsoft, Apple, and other major providers do not make unsolicited calls to warn you about infections. Any genuine communication with a tech company has to be started by you.
A real security warning from your operating system or browser will never include a phone number to call. If a pop-up urges you to ring a "support hotline" to remove a virus, the pop-up itself is the attack. Microsoft's error and warning messages never include phone numbers.
"Your licence expires today." "Your data will be deleted in 30 minutes." Urgency is the scammer's most effective tool because it pushes you past the moment where you would normally stop and verify. A legitimate support process gives you time to think.
If you did not independently contact a company for support, no one should be asking you to install remote-access software. Be wary of any caller or pop-up directing you to download AnyDesk, TeamViewer, or similar tools when you did not initiate the support request.
No genuine support technician needs your password, a one-time login code, or your full card number to "verify" your identity or fix a device. A request for any of these is a clear red flag. Real support will never ask you to read back a code your bank or email provider just sent you.
Legitimate companies do not ask for payment in gift cards, crypto, or wire transfers. The FTC is clear that scammers favour these methods because, once paid, it is hard to get your money back. Any "support" invoice demanding an unusual payment method is a scam.
A progress bar that "finds" a long list of threats within seconds, or a technician pointing at routine Event Viewer entries as proof of hacking, is theatre. Real security software does not need a stranger on the phone to interpret its results.
Scammers run fake support sites and buy ads so their numbers appear at the top of search results. A support phone number that does not match the one on the company's official website is a warning sign. If you reach a support page through an unexpected link, check a suspicious website URL before trusting it. Just remember that no automated tool can guarantee a site is safe, so verify the contact details independently even if a URL looks legitimate.
A common variant is a message claiming you have been charged hundreds for a "tech support subscription" you never bought, with a number to call for a refund. If you call, the scammer asks for remote access and banking details to "process" it. The FTC warns that these schemes impersonate brands like Geek Squad, McAfee, and Norton. If you see no such charge on your card statement, the message is a scam.
Scammers may talk over you, refuse to let you hang up, or keep your browser locked so you cannot close the page. Some try to convince you that hanging up will "lock" your computer. Any attempt to prevent you from ending the interaction or regaining control of your device is itself a warning sign.
Remote-access software lets someone view your screen and control your keyboard and mouse as if they were sitting in front of your computer. In the hands of a scammer, that access can be used to view files, documents, and photos stored on your device, read saved passwords from your browser or password manager, install additional software including malware or persistent backdoors, move money or authorise payments if you are logged in to online banking, change account settings or recovery details, and copy personal data for later identity fraud.
It is worth noting that not every remote-access session automatically results in malware or data theft. A scammer who gains access may do nothing visible, or may focus narrowly on a single goal. But because you cannot easily tell what was done, any unauthorised session should be treated as a serious exposure and followed up with the recovery steps below.
The safest response to any unsolicited support alert is to verify it independently, using channels you control. Start by closing suspicious pop-ups safely: do not call the number or download the suggested software, just close the browser tab or window. If the browser appears locked, see the section on closing a fake virus pop-up below.
Next, navigate to the official provider yourself. Type the company's web address directly into your browser or use the official app, and do not click links or call numbers supplied in the alert. Microsoft, Apple, and antivirus vendors all publish their real support contact details on their official websites, so use those rather than anything from a pop-up or caller.
If a message claims you were charged for a support subscription, check your card or bank statement directly. If there is no matching charge, the message is a scam; if there is an unfamiliar charge, report it to your bank. Finally, do not trust caller ID or professional-looking sites, since caller ID can be spoofed and a polished website is easy to fake. Neither is proof of legitimacy. Only contact that you initiate, through a verified channel, actually counts.
Act quickly and in order. These steps reduce harm, though they cannot guarantee that every trace of malware is removed or that lost money is recovered.
First, end the remote session and disconnect. Close the remote-access application, and if the scammer appears to still be active or you cannot regain control, disconnect your device from the internet by turning off Wi-Fi or unplugging the network cable. Then uninstall any remote-access apps the scammer asked you to install and check for unfamiliar software. If you are unsure, seek help from a trusted technical professional rather than running unknown cleanup tools.
Change exposed passwords from a separate, trusted device, starting with your email account and any financial accounts before working through the rest. Use a device the scammer did not access, in case your computer is compromised. Turn on multifactor authentication wherever it is available, and check your account's active sessions and recovery settings for anything you did not set up.
If payment details or financial accounts may have been exposed, contact your bank or card issuer using the number on your card or in your banking app, and ask for the card to be replaced and for transaction monitoring. Install operating system updates and run a scan with reputable, up-to-date security software; Microsoft Learn recommends running a full scan and applying all security updates. Preserve any messages, receipts, phone numbers, and screenshots as evidence, since they help when reporting and may support a fraud claim with your bank. Finally, report the incident using the guidance for your country below.
A fake virus pop-up wants you to panic and call. The right response is the opposite: do not call the number, do not download anything it suggests, and close the page.
On a computer, close the browser tab. If a dialogue box blocks you, try closing the whole browser window or using the browser's task manager to end the process. Some scam sites use full-screen mode or repeated dialogue loops to trap you, in which case force-quit the browser through your operating system's task manager (Ctrl+Shift+Esc on Windows, Cmd+Option+Esc on Mac) and reopen it. If it restores the locked tab, choose "reopen without restoring" or clear the session.
Do not run unknown commands or install cleanup tools. A scammer or scam site may tell you to run a command or download a "removal tool," but these are often the malware itself. Use only reputable security software you already trust. If you cannot close the pop-up, the browser keeps reopening the page, or your device behaves unusually afterwards, ask a trusted technical professional for help rather than following instructions from the alert.
The clearest way to tell them apart is to ask who initiated the contact and whether you can verify it independently. Real support begins with you, whether you called an official number or opened a support request through the company's site. Fake support is unsolicited: a pop-up, call, or message arrives out of nowhere.
Real support can be confirmed through the company's official website or app, whereas fake support gives you only the number or link in the alert, which you cannot independently verify. A legitimate technician may use remote-access software, but only after you initiated and authorised the session. Fake support demands remote access before any verification, often as the first step. Real support bills through official invoices or your account, while fake support insists on gift cards, crypto, wire transfers, or payment apps that are hard to reverse. And real support gives you time, whereas fake support manufactures urgency and tries to stop you hanging up or regaining control.
Remote access itself is not proof of fraud. A genuine technician you contacted may use it. The warning sign is unsolicited contact combined with pressure to grant access before you can verify who is on the other end.
Reporting helps authorities track and stop scammers, and procedures differ by country. In the United States, report to the FTC at ReportFraud.ftc.gov; Microsoft also accepts reports of Microsoft-impersonation scams through its report page. In the United Kingdom, report to Action Fraud at actionfraud.police.uk and forward suspicious texts to 7726. In Canada, report to the Canadian Anti-Fraud Centre at antifraudcentre.ca. In Australia, report to Scamwatch at scamwatch.gov.au.
If you lost money or shared financial details, also contact your bank or card issuer immediately through a number you trust.
A warning is almost certainly fake if it includes a phone number to call, appears as an unsolicited pop-up, or comes with pressure to act immediately. Genuine error messages from your operating system or browser never include a support phone number. If you did not initiate the contact, verify it independently through the company's official website or app before taking any action.
No. Microsoft and Apple do not call customers out of the blue to report infections or offer support. Microsoft states that it will never proactively reach out to provide unsolicited technical support, and that any communication with Microsoft has to be initiated by you. An unexpected call claiming your device is infected is a scam.
Yes. Remote-access software lets someone view your screen and control your device, which means they can open files, read saved passwords, copy personal data, and install additional software. Not every session results in theft, but because you cannot easily tell what was done, any unauthorised session should be treated as a serious exposure.
Disconnect your device from the internet, uninstall the remote-access app, and check for any other unfamiliar software. From a separate, trusted device, change your passwords starting with email and financial accounts, enable multifactor authentication, and run a security scan with reputable, up-to-date software. If payment details were exposed, contact your bank immediately.
Yes. A scammer with remote access can view your browser, read saved passwords, and move money if you are logged in to online banking. They may also ask for card details or one-time codes directly. If banking information may have been exposed, contact your bank or card issuer immediately through a verified number and ask for the card to be replaced and transactions monitored.
Do not call the number or download anything it suggests. Close the browser tab or window, and if a dialogue box blocks you, force-quit the browser through your operating system's task manager and reopen it without restoring the previous session. Do not run unknown commands or install cleanup tools from the alert. If the problem persists, seek help from a trusted technical professional.
Recovery is not guaranteed. If you paid by card, contact your card issuer immediately and report the transaction as fraud, since they may be able to reverse it. Payments made by gift card, cryptocurrency, wire transfer, or payment app are much harder to recover because they act like cash. Report the scam to your national authority promptly, as faster reporting can improve the chances.
In the US, report to the FTC at ReportFraud.ftc.gov. In the UK, report to Action Fraud. In Canada, contact the Canadian Anti-Fraud Centre. In Australia, report to Scamwatch. If you lost money or shared financial details, also contact your bank or card issuer immediately through a verified number.
Know in seconds if it’s a scam.
Paste an email, text or link. Scamlify’s AI returns a risk score, the exact red flags and what to do next — while teaching you the pattern behind the attack. No account, no storage, nothing logged.
Scamlify — AI-Powered Scam & Security Intelligence Platform. Sitemap.