Fake Microsoft or internet provider tech support: the remote access scam

Fake Microsoft or internet provider tech support: the remote access scam

The phone rings and a voice, often rushed and very professional-sounding, says they're a technician from "Microsoft's security team", from Apple support, from your antivirus company or, very often in New Zealand, from your broadband provider: "your internet connection has been hacked", "your IP address is being used by criminals", "we're going to disconnect you". To fix it, they need to connect to your computer, so they ask you to install a programme like AnyDesk or TeamViewer. This is the fake tech support scam, and it has one goal: to get into your computer and, from there, into your bank. The rule that takes it apart: Microsoft, Apple, antivirus companies and internet providers don't call out of the blue to tell you your device is infected.

How does the fake technician scam work?

The script barely changes, and knowing it is the best defence:

1. First contact. It can be a direct call, or it can start the other way round: while you're browsing, a window takes over the whole screen, sometimes with beeping or a voice, saying "Your computer has been blocked, call support" with a phone number. In that case you're the one calling, but the same scammers answer.
2. The "proof". They guide you into opening normal Windows or Mac tools, such as Event Viewer or a command window, and show you warnings and errors that exist on any healthy computer. "See all those red errors? That's the hacker."
3. Remote access. They talk you through downloading AnyDesk, TeamViewer, Windows Quick Assist or something similar and ask for the code on your screen. With that code they can see and control your computer as if they were sitting at it.
4. The payment. Sometimes they charge you directly for a "repair" or "security licence". Other times they say you're owed a refund and ask you to log into internet banking "to receive it". Meanwhile they black out the screen or change what you see, then claim they refunded too much by mistake and you must send back the difference by bank transfer, cryptocurrency or gift cards.
5. Staying in. If you let them, they install programmes so they can get back in later, steal passwords saved in your browser or ask for codes you receive by text "to verify the transaction".

What are the warning signs?

• You didn't ask for the call. No big tech company or telco watches your particular computer and rings to warn you about a virus.
• They ask you to install a remote control programme. A stranger who calls you has no legitimate reason to control your device.
• Urgency and fear. "If you hang up you'll lose everything", "your bank account is at risk", "don't switch the computer off".
• They ask you to log into your bank or read out a text code. No tech support ever needs to see your internet banking or your verification codes.
• Odd payment methods. Gift cards, cryptocurrency, transfers to individuals or "returning" a refund they supposedly overpaid.
• Pop-ups that lock your browser and show a phone number. Real Windows or macOS alerts never ask you to call anyone.
• The number on your screen proves nothing. Caller ID can be faked.

What do I do if they're calling me right now?

1. Hang up. No need to argue or explain. A real company won't hold it against you.
2. Don't install anything and don't read out any code. Not the AnyDesk or TeamViewer code, and not codes that arrive by text.
3. If there's a "computer blocked" window, close the browser. If it won't close, on Windows open Task Manager (Ctrl + Shift + Esc) and end the browser; on a Mac use Force Quit (Cmd + Option + Esc). If nothing responds, restart. When you reopen the browser, don't restore the previous tabs.
4. If you want to check, do it yourself. Contact Microsoft, Apple, your antivirus or your internet provider only through their official website or app, typed or opened by you, or the number on your bill, never the number from the call or the pop-up.
5. Block the number and report it in the spam numbers directory so others recognise it.

What if I already let them into my computer?

Act quickly and in this order. Nobody will judge you: this trick is designed to feel like a normal technical job.

1. Disconnect from the internet. Turn off Wi-Fi or unplug the network cable. That cuts the remote connection if it's still open.
2. Call your bank now on the number on your card or in its app, never one the scammers gave you. Explain that someone had remote access to your computer, ask them to block your cards and internet banking if needed and go through recent transactions with them. If you logged into your bank during the call, this comes first.
3. Uninstall the remote access programme (AnyDesk, TeamViewer or whatever they had you install) and check for other programmes you don't recognise that were installed the same day.
4. Change your passwords from another, clean device, such as your phone: your email first, then your bank and other important accounts. Turn on two-step verification wherever you can. If you saved passwords in that computer's browser, treat them as compromised. Own Your Online, the government's cyber security advice site, has simple guides for this.
5. Scan the computer with trusted antivirus. If they had control for a long time or installed things you can't identify, the safest option is to get a technician you trust to check it or restore it, after backing up your personal files.
6. If you paid by card or bank transfer, tell your bank as soon as possible: the window to try to stop or dispute a payment is short.

How do I report it?

• The National Cyber Security Centre (NCSC). Report the incident through the NCSC. It handles scam and cyber security reports from the public and can tell you what to do next.
• NZ Police. If you've lost money or your accounts were accessed, report it on 105 or through the 105 online service on the NZ Police website. Bring the number that called you (or the one in the pop-up), the date and time, the company they claimed to be from, the name of the programme you installed and receipts or screenshots of transactions. Your bank may ask for the Police reference number.
• Your bank, always through its official channel.
• The company being impersonated. Microsoft, for example, lets you report tech support scams through its official website, and most NZ telcos have a scam-reporting page on their own sites.

Consumer Protection's Scamwatch also explains how to protect yourself after a scam. If you ever feel you're in danger, call 111.

How do I protect myself next time?

• Remember the golden rule: if someone calls to say your computer or internet connection has a problem, it's a scam. Every time.
• Talk to older relatives about it. This scam hits older people and those less confident with computers hardest. Agree something simple: "if anyone asks you to install something on the computer, hang up and call me".
• Keep your system and browser up to date and use legitimate antivirus. Updates arrive on their own, not over the phone.
• Don't save banking passwords in the browser, and turn on two-step verification for email and banking.
• Use a call filter. Apps like NoCall warn you when a number has already been reported as a scam, which gives you a head start before you answer.

Frequently asked questions

Can Microsoft or my internet provider really call me? Only if you've already contacted them and asked for a call back about a specific issue. Never out of the blue to say your device is infected or your connection has been hacked.

They called, but I didn't install anything. Am I at risk? If you didn't install anything and didn't give out codes or banking details, there's no harm done. Block the number and report it.

Are AnyDesk and TeamViewer dangerous? No: they're legitimate tools used by many companies. The problem isn't the programme, it's who you give the code to. Only give remote access to someone you know and called first.

They called again saying they can get my money back. Is that real? Almost certainly it's a second scam, often by the same people. No legitimate organisation asks for an upfront fee to recover what you lost. Hang up and tell Police.

In short

The fake technician doesn't fix anything: they win your trust with fear and cash it in from your own computer. Hang up, don't install anything and don't read out any codes. If you've already given access: disconnect, call your bank, change your passwords from another device, clean the computer and report it to the NCSC and Police. And if one of these numbers has called you, report it in the NoCall spam numbers directory.