Fake Microsoft technician: they call because your computer "has a virus"

Fake Microsoft technician: they call because your computer "has a virus"

The phone rings and a voice, often rushed and very professional, says they are a technician from "Microsoft's security department", from Apple support or from your antivirus company. They say they have detected that your computer is infected, that it is sending out errors or that someone is using it to attack others, and that they need to connect to it to fix it. To do that, they ask you to install a program such as AnyDesk or TeamViewer. This is the fake tech support scam, and it has one goal: to get into your computer and, from there, into your bank. The rule that takes it apart: Microsoft, Apple and antivirus companies do not call you out of the blue to say your device has a virus.

How does the fake technician scam work?

The script barely changes from one wave to the next, and knowing it is the best defence:

1. First contact. It can be a direct call, or it can start the other way round: while you are browsing, a window fills the whole screen, sometimes with beeps or a voice, saying "Your computer has been blocked, call technical support" and showing a phone number. In that case you are the one who calls, but the same scammers are on the other end.
2. The "proof" of the problem. They talk you into opening normal Windows or Mac tools, such as Event Viewer or a command window, and show you warnings and errors that exist on any healthy computer. "See all those red errors? That's the virus."
3. Installing remote access. They guide you to download AnyDesk, TeamViewer, Windows Quick Assist or a similar tool and ask for the code on your screen. With that code they can see and control your computer as if they were sitting in front of it.
4. The payment. Here the script splits. Sometimes they charge you directly for a "repair" or a "security licence". Other times they say you are owed a refund and ask you to log in to your online banking "so we can pay it in". Meanwhile they black out the screen or change what you see, then claim they refunded you too much by mistake and that you must send back the difference by EFT, cryptocurrency or gift vouchers.
5. Staying in. If you let them, they install programs so they can get back in later, steal passwords saved in your browser or ask for the OTPs you receive by SMS "to verify the transaction".

What are the warning signs?

• You did not ask for the call. No big tech company watches your particular computer and phones you about an infection.
• They ask you to install a remote-control program. A stranger who calls you has no legitimate reason to control your device.
• Urgency and fear. "If you hang up you will lose all your data", "your bank account is at risk", "don't switch the computer off".
• They ask you to log in to your bank or read out an OTP. No tech support ever needs to see your online banking or your one-time PINs.
• Odd payment methods. Gift vouchers, cryptocurrency, transfers to individuals, or "returning" a refund they supposedly overpaid.
• Windows that lock your browser and show a phone number. Real Windows or macOS alerts never ask you to call anyone.
• The number on your screen proves nothing. Caller ID can be faked; a number that looks official does not mean it is.

What do I do if they are calling me right now?

1. Hang up. There is no need to argue or explain. If in doubt, hang up anyway: a real company will never hold it against you.
2. Do not install anything and do not read out any code. Not the AnyDesk or TeamViewer code, and not the OTPs you receive by SMS.
3. If a "computer blocked" window is on your screen, close the browser. If it will not close, on Windows open Task Manager (Ctrl + Shift + Esc) and end the browser; on a Mac use "Force Quit" (Cmd + Option + Esc). If nothing responds, restart the computer. When you reopen the browser, do not restore the previous tabs.
4. If you want to check something, do it yourself. Contact Microsoft, Apple or your antivirus company only through their official website, which you type in yourself, or through the program itself. Microsoft explains how to recognise and report these calls on its tech support scams page.
5. Block the number and report it in the spam numbers directory so that others recognise it when they get the call.

What if I already gave them access to my computer?

Act quickly and in this order. Nobody is going to judge you: this trick is designed to feel like a normal technical procedure.

1. Disconnect the computer from the internet. Turn off Wi-Fi or unplug the network cable. That cuts the remote connection if it is still open.
2. Call your bank's fraud line now, on the number on the back of your card or in the banking app, never one the scammers gave you. Explain that someone had remote access to your computer, ask them to block your cards and online banking if necessary and go through your recent transactions with them. If you logged in to your bank during the call, this comes first.
3. Uninstall the remote access program (AnyDesk, TeamViewer or whatever they had you install) and look for other programs you do not recognise that were installed the same day.
4. Change your passwords from another, clean device, such as your phone: first your email, then your banking and your other important accounts. Switch on two-step verification wherever you can. If you saved passwords in the browser on that computer, treat them as compromised.
5. Scan the computer with a trusted antivirus. If the scammers had control for a long time or installed things you cannot identify, the safest option is to have a technician you trust check it or fully restore it, after backing up your personal files.
6. If you paid by card or EFT, tell your bank as soon as possible: the window to stop or dispute a payment is short. You will find more about getting money back on our blog.

How do I report it?

Open a case at your nearest police station (SAPS) and ask for the case number. Take:

• The number they called from (or the one shown in the window), the date and the time.
• The name and the company they claimed to represent.
• The name of the program they had you install.
• Proof of any payment and screenshots of the bank transactions.

Give the case number to your bank as well: they usually ask for it to process a claim. If at any point you feel in danger, call 10111, or 112 from a cellphone. You can also tell the company being impersonated: Microsoft lets you report tech support scams through its official website.

How do I protect myself next time?

• Remember the golden rule: if someone calls to tell you your computer has a problem, it is a scam. Every time.
• Talk about it with older relatives. This is one of the scams that most affects older people and those less used to computers. Agree on something simple: "if anyone asks you to install something on the computer, hang up and call me".
• Keep your system and browser up to date and use legitimate antivirus software. Updates arrive on their own, not over the phone.
• Do not save your banking passwords in the browser and switch on two-step verification for your email and banking.
• Use a call filter. Apps like NoCall warn you when a number has already been reported by other people, which gives you a few seconds' head start before you answer.

Frequently asked questions

Can Microsoft or Apple really call me? Only if you have already opened a support request with them and asked to be called back. Never out of the blue to say your device is infected.

They called, but I didn't install anything. Am I at risk? If you did not install anything or give out codes or banking details, no harm is done. Block the number and report it. If they call again, just hang up.

Are AnyDesk and TeamViewer dangerous programs? No: they are legitimate tools used by many companies and technicians. The problem is not the program but who you give the code to. Only give remote access to someone you know and whom you called first.

They called back saying they can get my money back. Is that real? Almost certainly it is a second scam, often by the same people or by whoever bought your details. Nobody legitimate asks for an upfront fee to recover what you lost. Hang up and mention it in your police case.

In short

The fake Microsoft technician does not fix anything: they buy your trust with fear and cash it in from your own computer. Hang up, do not install anything and do not read out any codes. If you already gave them access: disconnect from the internet, call your bank's fraud line, change your passwords from another device, clean the computer and open a case. And if one of these numbers has called you, report it in the NoCall spam numbers directory: your warning could help someone else hang up in time.