Fake Microsoft technician: the call saying your computer "has a virus"

Fake Microsoft technician: the call saying your computer "has a virus"

The phone rings and a voice, often rushed and very professional-sounding, introduces itself as a technician from "Microsoft's security department", from Apple support, from your broadband provider or from your antivirus company. They say they've detected that your computer is infected, that it's sending out errors or that someone is using it to attack others, and that they need to connect to fix it. To do that, they ask you to install a program such as AnyDesk or TeamViewer. This is the tech support scam, and it has one goal: to get into your computer and, from there, into your bank. The rule that takes it all apart: Microsoft, Apple and antivirus companies don't ring out of the blue to tell you your device has a virus.

How does the fake technician scam work?

The script barely changes from one wave to the next, and knowing it is the best defence:

1. First contact. It can be a direct call, or it can start the other way round: while you're browsing, a window fills the whole screen, sometimes with beeps or a voice, saying "Your computer has been blocked, call technical support" and showing a phone number. In that case you're the one who calls, but the same scammers are on the other end.
2. The "proof" of the problem. They talk you into opening normal Windows or Mac tools, such as Event Viewer or a command window, and point to warnings and errors that exist on any healthy computer. "See all those red errors? That's the virus."
3. Installing remote access. They guide you through downloading AnyDesk, TeamViewer, Windows Quick Assist or something similar, and ask for the code on screen. With that code they can see and control your computer as if they were sitting in front of it.
4. The payment. Here the script branches. Sometimes they charge you for a "repair" or a "security licence". Other times they say you're owed a refund (for an expired subscription or a service you've cancelled) and ask you to log into your online banking "so it can be paid in". Meanwhile they black out the screen or doctor what you see, then claim they refunded too much by mistake and that you must send back the difference by bank transfer, cryptocurrency or gift cards.
5. Staying in. If you let them, they install programs so they can get back in later, steal passwords saved in your browser or ask for the codes your bank texts you "to verify the transaction".

What are the warning signs?

• You didn't ask for the call. No big tech company monitors your particular computer and rings you about an infection.
• They ask you to install a remote control program. A stranger who calls you has no legitimate reason to control your device.
• Urgency and fear. "If you hang up, you'll lose all your files", "your bank account is at risk", "don't turn the computer off".
• They ask you to log into your bank or read out a code from a text. No tech support ever needs to see your online banking or your one-time passcodes.
• Odd payment methods. Gift cards, cryptocurrency, transfers to individuals, or "returning" a refund they supposedly overpaid.
• Windows that lock your browser and show a phone number. Genuine Windows or macOS alerts never ask you to call anyone.
• The number on your screen proves nothing. Caller ID can be faked; an official-looking number doesn't mean it's real.

What do I do if they're calling me right now?

1. Hang up. No need to argue or explain. A real company will never hold it against you for ending the call.
2. Don't install anything and don't read out any code. Not the AnyDesk or TeamViewer code, and not the ones you receive by text.
3. If a "computer blocked" window is on screen, close the browser. If it won't close, on Windows open Task Manager (Ctrl + Shift + Esc) and end the browser; on a Mac, use Force Quit (Cmd + Option + Esc). If nothing responds, restart the computer, and don't restore the previous tabs when you reopen the browser.
4. If you want to check something, do it yourself. Contact Microsoft, Apple, your broadband provider or your antivirus company only through their official website, typed in by you, or through the program itself, never through the number from the call or the window.
5. Block the number and report it in the spam numbers directory so others recognise it.

What if I've already given them access?

Act quickly and in this order. Nobody is going to judge you: this trick is designed to feel like a normal technical procedure.

1. Disconnect the computer from the internet. Turn off Wi-Fi or unplug the network cable. That cuts the remote connection if it's still open.
2. Call your bank now. Dial 159 to be connected securely to many UK banks, or use the number on the back of your card, never one the scammers gave you. Explain that someone had remote access to your computer, ask them to block your cards and online banking if needed, and go through recent transactions with them. If you logged into your bank during the call, this comes first.
3. Uninstall the remote access program (AnyDesk, TeamViewer or whatever they had you install) and look for any other software you don't recognise that was installed the same day.
4. Change your passwords from another, clean device, such as your phone: your email first, then your bank and other important accounts. Turn on two-step verification wherever you can. Treat any passwords saved in that computer's browser as compromised. The NCSC has a step-by-step guide to recovering a hacked account.
5. Scan the computer with reputable antivirus software. If the scammers had control for a long time or installed things you can't identify, the safest option is to have a technician you trust check it or fully reset it, after backing up your personal files.
6. If you paid by card or bank transfer, tell your bank as soon as possible: the window to stop or dispute a payment is short. There's more on recovery options on the NoCall blog.

How do I report it?

Report it to Report Fraud (formerly Action Fraud) on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101. Have to hand:

• The number they called you from (or the one shown in the window), the date and the time.
• The name and company they claimed to represent.
• The name of the program they had you install.
• Receipts for any payment and screenshots of the bank transactions.

You'll get a crime reference number; give it to your bank, as they may ask for it when handling your claim. If you feel you're in danger, call 999. You can also tell the company being impersonated: Microsoft, for example, lets you report tech support scams through its official website. The NCSC explains how to report scam calls.

How do I protect myself next time?

• Keep the golden rule in mind: if someone rings to say your computer has a problem, it's a scam. Every time.
• Talk about it with older relatives. This scam hits older people and those less confident with computers hardest. Agree something simple: "if anyone asks you to install something on the computer, hang up and ring me".
• Keep your system and browser up to date and use legitimate security software. Updates arrive on their own, not over the phone. The NCSC's guide to securing your devices covers the basics.
• Don't save banking passwords in the browser, and turn on two-step verification for your email and bank.
• Use a call filter. Apps like NoCall warn you when a number has already been reported as a scam by others, giving you a few seconds' head start before you answer.

Frequently asked questions

Can Microsoft or Apple really call me? Only if you've already opened a support request with them and asked for a call back. Never out of the blue to say your device is infected.

They called but I didn't install anything. Am I at risk? If you didn't install anything or give out codes or bank details, there's no harm done. Block the number and report it. If they ring again, just hang up.

Are AnyDesk and TeamViewer dangerous? No: they're legitimate tools used by many companies and technicians. The problem isn't the program but who you give the code to. Only give remote access to someone you know and whom you contacted first.

They called again saying they can get my money back. Is that real? Almost certainly a second scam, often by the same people or whoever bought your details. Nobody legitimate asks for an upfront fee to recover what you lost. Hang up and mention it when you report.

In short

The fake Microsoft technician doesn't fix anything: they buy your trust with fear and cash it in through your own computer. Hang up, don't install anything and don't read out codes. If you've already given access: disconnect from the internet, call 159 or your bank, change your passwords from another device, clean the computer and report it. And if one of these numbers has called you, report it in the NoCall spam numbers directory: your warning could help someone else hang up in time.