Tech support and remote-access scams

A loud pop-up says your computer is infected and to call a number. Or someone phones claiming to be from Microsoft, Apple or your broadband provider. Or an email says a pricey subscription just renewed. Call to cancel.

In short

Pop-ups saying your computer is infected, or calls from "Microsoft". How tech support scams work and what to do if someone accessed your device.

Top warning signs: A pop-up with a phone number; Unsolicited calls from big tech companies; Being asked to install remote access software.

First thing to do: Close the browser. If it won't close, restart the computer. Don't call the number.

Example · Browser pop-upIllustrative, links disabled
Security Alert
⚠ WINDOWS DEFENDER ALERT: Your computer has been infected with a Trojan spyware. Your banking details and photos are at risk. Do not close this window. Call Microsoft Support immediately: +1 (888) 000-0000
An example scam message with the warning signs highlighted.

How the scam works

When you call, a “technician” asks you to install a remote access app such as AnyDesk, TeamViewer or Quick Assist. They show you fake “errors”, then charge for a fix. Or, in the refund version, they claim to have refunded you too much and ask you to send the difference back from your online banking while they watch.

With remote access they can also install malware or move money themselves.

Red flags to look for

  • A pop-up with a phone number. Real security warnings never ask you to call someone.
  • Unsolicited calls from big tech companies. Microsoft and Apple don't cold-call about viruses.
  • Being asked to install remote access software. Only do this with IT support you contacted yourself and trust.
  • A “refund” that went wrong. The overpayment refund story is a script.

What to do if you get one

  1. Close the browser. If it won't close, restart the computer. Don't call the number.
  2. If someone calls you, hang up.
  3. For subscription emails, log in to the real account yourself to check.

If you already paid or shared details

Act quickly. It makes a difference.

  1. Disconnect the device from the internet and uninstall any remote access app they asked you to install.
  2. From a different device, change your email and banking passwords and turn on two-step verification.
  3. Call your bank. Then run a reputable security scan or get help from a trusted local repair shop.

More help: what to do after a scam, and where to report it in your country.

Questions people ask

Can a web page really infect my computer by showing a warning?

The scary pop-up itself is just a web page. Closing it is usually enough. The danger starts when you call and give access.

Official sources and further reading

We check our guides against advice from government agencies and consumer protection bodies.