The basic idea
A tech support scam convinces you that something is wrong with your computer, phone or account, and then persuades you to pay for a fix you do not need or to give someone control of your device. The “problem” is invented. The urgency, the technical language and the offer of help are the whole product.
They come in two main forms: a warning that appears on your screen, and an unexpected phone call.
Fake warning pop-ups
You are browsing, and a page suddenly fills the screen with a loud warning. It might claim that viruses have been found, that your data is being stolen or that your computer is locked. It may include an official-looking logo, flashing colours, an alarm sound or a countdown. A phone number is displayed, with an instruction to call immediately.
Several things are worth understanding:
- It is a web page, not your computer. The message is just content from a website, designed to look like a system alert. Real security software and the operating system do not generally ask you to phone a number in a browser window.
- Browsers are tricked into looking stuck. Some pages open in full-screen mode, hide the cursor, or repeat dialogue boxes so closing them feels impossible. This is a trick of display rather than damage to the machine.
- The brand names are borrowed. Logos from well-known software or technology companies are copied to look genuine.
These pages are often reached through mistyped addresses, misleading adverts, search results or links in messages. Some are connected to lookalike domains.
Cold calls
In the other version, someone phones you and says they are from a well-known technology company, your internet provider or “the security department”, and that your computer has been sending out error messages or has been hacked. The caller ID may look official, but, as explained under caller ID spoofing, that proves nothing.
Companies of this kind do not normally monitor individual home computers and ring people unprompted. If you did not contact them first, the premise is almost certainly false.
What happens next
If you call the number or answer the phone, the usual script runs along these lines:
- “Proof” of a problem. The caller guides you to a harmless part of your system, such as an event log that lists routine warnings and errors, and calls them signs of infection. Almost every working computer shows such entries.
- Remote access. You are asked to install a remote-control tool or to let them connect so they can “fix” it. This gives them control of your screen, files and possibly saved logins.
- Fake fixing. You watch while the screen shows commands or scans.
- Payment. You are charged for a one-off repair, a subscription or a “lifetime protection” plan. Payment may be requested by card, transfer or gift cards.
- Follow-ups. The caller may later offer a fake refund, then arrange for “too much” refund to be returned, a trick with the same logic as an overpayment scam. They may also come back repeatedly, since you are now a known target.
Once remote access is granted, other harm is possible: installing unwanted software, viewing banking pages or collecting passwords.
Warning signs
- A warning that includes a phone number to call.
- An unsolicited call or message claiming a problem with your device.
- Insistence that you act immediately, stay on the line or tell nobody.
- A request to install software that gives someone control of your device.
- Payment through gift cards or other hard-to-trace routes.
- Claims that your device is in danger on the basis of ordinary error logs.
What to do if a pop-up appears
- Do not call the number or click anything inside the page.
- Try closing the tab or window. If the browser seems locked, try closing it using the system’s own method, such as the standard key combination to force a program to quit on your device, or restart the device. If it offers to restore the previous session after restarting, decline.
- Run your security software if you have it, and make sure software updates are installed, as updates close weaknesses that malicious pages can use.
- Reset the browser if the pop-ups continue, and remove any unfamiliar browser extension you did not install deliberately.
What to do after a call
If you hung up without acting, you do not need to do anything except possibly warn others. If you allowed remote access or paid:
- Disconnect from the internet and remove any remote-access tool installed during the call.
- Change passwords from a different, trusted device, starting with email and banking, and turn on two-factor authentication.
- Contact your bank or card provider about any payment and watch your accounts closely.
- Consider seeking help from a trusted repair service you choose yourself, or a technically confident friend.
- Back up important files before cleaning anything; the importance of data backup and recovery is hard to overstate here.
More general steps appear in scam recovery steps. Results vary and funds cannot be promised back, but acting promptly generally helps.
A rule that covers most cases
Real technical support is something you ask for, from a contact route you found yourself. A person or pop-up that starts the conversation, creates urgency and asks for access or payment is following a familiar script, and the safe response is to close, hang up and verify elsewhere.