Fake Microsoft technician: they call because your computer "has a virus"

Fake Microsoft technician: they call because your computer "has a virus"

The phone rings and a voice, often hurried and very professional-sounding, introduces itself as a technician from "Microsoft's security department", from Apple support or from your antivirus company. They say your computer is infected, that it is sending out errors or that someone is using it to attack others, and that they need to connect to fix it. To do that, they ask you to install a program such as AnyDesk or TeamViewer. This is the fake tech support scam, and it has only one goal: to get into your computer and, from there, into your bank. The rule that takes it all apart: Microsoft, Apple and antivirus companies do not call out of the blue to tell you your device has a virus.

How does the fake technician scam work?

The script barely changes from one wave to the next:

1. First contact. It can be a direct call, often from an overseas number. Or it starts the other way round: while you browse, a window fills the whole screen, sometimes with beeps or a voice, saying "Your computer has been blocked, call technical support" and showing a phone number. Then you are the one who calls, but the same scammers are on the other end.
2. The "proof". They guide you into opening normal Windows or Mac tools, such as Event Viewer or a command window, and show you warnings that exist on any healthy computer. "See all those red errors? That's the virus."
3. Installing remote access. They talk you through downloading AnyDesk, TeamViewer, Windows Quick Assist or similar and ask for the code on screen. With that code they can see and control your computer as if they were sitting in front of it.
4. The payment. Sometimes they charge for a "repair" or a "security licence". Other times they say you are owed a refund and ask you to log in to your online banking "to receive it". Meanwhile they black out the screen, then claim they refunded too much and you must send back the difference by bank transfer, cryptocurrency or gift cards.
5. Staying in. They install programs to get back in later, steal passwords saved in your browser or ask for the OTP or approval in your banking app "to verify the transaction".

In Singapore, a variant combines this with other impersonations: the "technician" says your internet line or your bank account has been hacked and transfers you to a fake bank officer or a fake police officer.

What are the warning signs?

• You did not ask for the call. No big tech company monitors your computer and calls you about an infection.
• They ask you to install a remote control program. A stranger who calls you has no legitimate reason to control your device.
• Urgency and fear. "If you hang up, you will lose all your data", "your bank account is at risk".
• They ask you to log in to your bank, approve a transaction in your banking app or read out an OTP. No tech support ever needs this.
• Odd payment methods. Gift cards, cryptocurrency, transfers to individuals or "returning" an overpaid refund.
• A browser window that locks the screen and shows a phone number. Real Windows or macOS alerts never ask you to call anyone.
• The number on your screen proves nothing. Caller ID can be faked.

What do I do if they are calling me right now?

1. Hang up. There is no need to argue or explain.
2. Do not install anything and do not read out any code, neither the AnyDesk or TeamViewer code nor any OTP.
3. If there is a "computer blocked" window, close the browser. On Windows, open Task Manager (Ctrl + Shift + Esc) and end the browser; on a Mac, use Force Quit (Cmd + Option + Esc). If nothing responds, restart. When you reopen the browser, do not restore the previous tabs.
4. If you want to check something, do it yourself, through the official website or the program itself, never through the number given in the call or the window.
5. Block the number, report it through ScamShield and in the spam numbers directory so others recognise it.

What if I already gave them access to my computer?

Act quickly and in this order. Nobody is judging you: this trick is designed to feel like a normal technical procedure.

1. Disconnect the computer from the internet. Turn off Wi-Fi or unplug the network cable.
2. Call your bank now, on the official number on your card or in its app. Explain that someone had remote access, ask them to block your cards and online banking if needed, and go through recent transactions together. If you logged in to your bank during the call, this comes first. Your bank's emergency "kill switch" can freeze your accounts immediately.
3. Uninstall the remote access program and check for other programs you do not recognise that were installed the same day.
4. Change your passwords from another, clean device: first your email, then your bank and other important accounts, and check your Singpass security settings. Turn on two-factor authentication everywhere. Treat passwords saved in that browser as compromised.
5. Scan the computer with trusted antivirus software. If the scammers had control for a long time, have a technician you trust check it or fully restore it after backing up your files. SingCERT, part of the Cyber Security Agency of Singapore, publishes advisories and accepts incident reports.
6. If you paid by card or transfer, tell your bank as soon as possible: the window to stop or dispute a payment is short. ScamShield's I've been scammed page sets out the next steps.

How do I report it?

Make a police report online through SPF e-services or at a Neighbourhood Police Centre. Have ready:

• The number that called you (or the one shown in the window), the date and the time.
• The name and company they claimed to represent.
• The name of the program they had you install.
• Receipts for any payment and screenshots of the bank transactions.

Give your bank the police report number too. If you feel you are in danger, call 999. You can also alert the company being impersonated: Microsoft accepts reports of tech support scams through its Report Fraud page.

How do I protect myself next time?

• Remember the golden rule: if someone calls to tell you your computer has a problem, it is a scam. Every time.
• Talk about it with older relatives. Agree on something simple: "if anyone asks you to install something on the computer, hang up and call me".
• Keep your system and browser updated and use legitimate antivirus software. Updates arrive on their own, not over the phone.
• Do not save banking passwords in the browser, and only install apps from official app stores.
• Use a call filter. The ScamShield app and NoCall warn you when a number has already been reported, which gives you a few seconds' head start.

Frequently asked questions

Can Microsoft or Apple really call me? Only if you have already opened a support request and asked to be called back. Never out of the blue to say your device is infected.

They called but I did not install anything. Am I at risk? If you did not install anything or give out codes or banking details, there is no harm done. Block and report the number.

Are AnyDesk and TeamViewer dangerous? No, they are legitimate tools. The problem is who you give the code to. Only give remote access to someone you know and whom you contacted first.

They called again saying they can recover my money. Is that real? Almost certainly it is a second scam. No legitimate party asks for an upfront fee to recover what you lost. Hang up and add it to your police report.

In short

The fake technician does not fix anything: they buy your trust with fear and cash it in from your own computer. Hang up, install nothing and read out no codes. If you already gave access: disconnect, call your bank, change passwords from another device, clean the computer and make a police report. And if one of these numbers has called you, report it in the NoCall spam numbers directory.