Fake Microsoft technician: they call because your computer "has a virus"

The phone rings and a voice, often hurried and very professional-sounding, introduces itself as a technician from "Microsoft's security department", from Apple support or from your antivirus company. They say they have detected that your computer is infected, that it is sending out errors or that someone is using it to attack others, and that they need to connect to fix it. To do that, they ask you to install a program such as AnyDesk or TeamViewer. This is the fake tech support scam, and it has only one goal: to get into your computer and, from there, into your bank. The rule that takes it all apart: Microsoft, Apple and antivirus companies do not call out of the blue to tell you your device has a virus.

How does the fake technician scam work?

The script barely changes from one wave to the next, and knowing it is the best defence:

1. First contact. It can be a direct call, or it can start the other way round: while you browse, a window appears that fills the whole screen, sometimes with beeps or a voice, saying "Your computer has been blocked, call technical support" and showing a phone number. In that case you are the one who calls, but the same scammers are on the other end.
2. The "proof" of the problem. They guide you into opening normal Windows or Mac tools, such as Event Viewer or a command window, and show you warnings and errors that exist on any healthy computer. "See all those red errors? That's the virus."
3. Installing remote access. They talk you through downloading AnyDesk, TeamViewer, Windows Quick Assist or a similar tool and ask for the code shown on screen. With that code they can see and control your computer as if they were sitting in front of it.
4. The payment. Here the script branches. Sometimes they charge you directly for a "repair" or a "security licence". Other times they say you are owed a refund (for an expired subscription or a service you no longer use) and ask you to log into your online banking "to pay it in". Meanwhile, they black out the screen or manipulate what you see, and then claim they accidentally refunded you too much and that you must send back the difference by bank transfer, cryptocurrency or gift cards.
5. Staying in. If you let them, they install programs so they can get back in later, steal passwords saved in your browser or ask for the codes you receive by text message "to verify the transaction".

What are the warning signs?

• You did not ask for the call. No big tech company monitors your particular computer and calls you to warn you about an infection.
• They ask you to install a remote control program. A stranger who calls you has no legitimate reason to control your device.
• Urgency and fear. "If you hang up, you will lose all your data", "your bank account is at risk", "don't switch the computer off".
• They ask you to log into your bank or read out a text message code. No tech support ever needs to see your online banking or your verification codes.
• Odd payment methods. Gift cards, cryptocurrency, transfers to individuals or "returning" a refund they supposedly overpaid.
• Windows that lock your browser and show a phone number. Real Windows or macOS alerts never ask you to call anyone.
• The number on your screen proves nothing. Caller ID can be faked; a number that looks official does not mean it is.

What do I do if they are calling me right now?

1. Hang up. There is no need to argue or explain. If in doubt, hang up anyway: a real company will never hold it against you for ending the call.
2. Don't install anything and don't read out any code. Not the AnyDesk or TeamViewer code, and not the ones you receive by text message.
3. If there is a "computer blocked" window on screen, close the browser. If it won't close, on Windows open Task Manager (Ctrl + Shift + Esc) and end the browser; on a Mac, use "Force Quit" (Cmd + Option + Esc). If nothing responds, restart the computer. When you reopen the browser, don't restore the previous tabs.
4. If you want to check something, do it yourself. Contact Microsoft, Apple or your antivirus only through their official website, typed in by you, or through the program itself, never through the number you were given on the call or in the window.
5. Block the number and report it in the spam number directory so others recognise it when they get the call.

What if I already gave them access to my computer?

Act quickly and in this order. Nobody is going to judge you: this trick is designed to feel like a normal technical procedure.

1. Disconnect the computer from the internet. Turn off Wi-Fi or unplug the network cable. That cuts the remote connection if it is still open.
2. Call your bank now, on the official number printed on your card or shown in its app, never one the scammers gave you. Explain that someone had remote access to your computer, ask them to block your cards and online banking if necessary and go through your recent transactions with them. If you logged into your bank during the call, this comes first.
3. Uninstall the remote access program (AnyDesk, TeamViewer or whatever they had you install) and check for other programs you don't recognise that were installed the same day.
4. Change your passwords from another, clean device, such as your phone: first your email, then your bank and your other important accounts. Turn on two-step verification wherever it is available. If you saved passwords in the browser on that computer, treat them as compromised.
5. Scan the computer with a trusted antivirus. If the scammers had control for a long time or installed things you can't identify, the safest option is to have a technician you trust check the computer or fully restore it, after backing up your personal files.
6. If you paid by card or bank transfer, tell your bank as soon as possible: the window to try to stop or dispute a payment is short. We cover the options in how to recover money lost to a phone scam.
7. Get help. In Spain, INCIBE's 017 is a free, confidential cybersecurity helpline that can guide you step by step, and the Oficina de Seguridad del Internauta (OSI, Spain's internet user security office) has guides for cleaning and protecting your computer. Elsewhere, look for your national cybersecurity agency or consumer protection helpline.

How do I report it?

In Spain, file a report with the Policía Nacional (091) or the Guardia Civil (062), at a police station, with everything you have. Elsewhere, report it to your national police. Bring:

• The number they called you from (or the one shown in the window), the date and the time.
• The name and company they claimed to represent.
• The name of the program they had you install.
• Receipts for any payment and screenshots of the bank transactions.

Give a copy of the police report to your bank too: they usually ask for it to process claims. If at any point you feel you are in danger or it is an emergency, call 112 in Europe, or your local emergency number. You can also alert the company being impersonated: Microsoft, for example, lets you report tech support scams through its official website.

How do I protect myself next time?

• Keep the golden rule in mind: if someone calls to tell you your computer has a problem, it's a scam. Every time.
• Talk about it with older relatives. This is one of the scams that most affects older people or those less familiar with computers. Agree on something simple: "if anyone asks you to install something on the computer, hang up and call me".
• Keep your system and browser up to date and use legitimate antivirus software. Updates arrive on their own, not over the phone.
• Don't save your banking passwords in the browser and turn on two-step verification for your email and banking.
• Use a call filter. Apps like NoCall warn you when a number has already been reported as a scam by other people, which gives you a few seconds' head start before you answer.

Frequently asked questions

Can Microsoft or Apple really call me? Only if you have already opened a support request with them and asked to be called back. Never out of the blue to tell you your device is infected.

They called, but I didn't install anything. Am I at risk? If you didn't install anything and didn't give out codes or banking details, there's no harm done. Block the number and report it. If they call again, just hang up.

Are AnyDesk and TeamViewer dangerous programs? No: they are legitimate tools used by many companies and technicians. The problem is not the program, but who you give the code to. Only give remote access to someone you know and whom you called first.

They called again saying they can get my money back. Is that real? Almost certainly it's a second scam, often by the same people or by whoever bought your details. No legitimate party will ask for an upfront payment to recover what you lost. Hang up and tell the police along with your report.

In short

The fake Microsoft technician doesn't fix anything: they buy your trust with fear and cash it in from your own computer. Hang up, don't install anything and don't read out any codes. If you already gave them access: disconnect from the internet, call your bank, change your passwords from another device, clean the computer and report it. And if one of these numbers has called you, report it in the NoCall spam number directory: your warning could help someone else hang up in time.