Tech support scams and fake virus warnings: what to do

Your screen suddenly fills with a red warning. "Your computer is infected. Do not close this window. Call Microsoft Support immediately." There may be a siren sound, a countdown, a page that won't close and a phone number. Or someone calls you claiming to be from your internet provider, Microsoft, Apple or your bank's "security team", saying your computer is sending out viruses.

These are tech support scams. The warning is fake, the support line is a call centre run by scammers, and the goal is to get remote access to your computer and then your money.

How tech support scams start

Fake pop-up warnings

Most start with a web page designed to look like a system alert. You might land there through a mistyped address, a malicious ad, a fake download button or a search result. The page:

• goes full screen and is hard to close
• plays an alarm or a recorded voice
• shows a fake virus scan with alarming results
• uses the logos of Microsoft, Apple, Windows Defender or a well-known antivirus brand
• tells you to call a phone number right now and not to restart your computer

None of this means your computer is infected. It's just a web page.

Cold calls

Someone calls you and says they're from Microsoft, Apple, your broadband provider or a security company. They say they've detected a problem with your computer or that your IP address has been "hacked". They're friendly, patient and very convincing.

Big tech companies don't cold-call people about infected computers. If you didn't contact them first, it isn't them.

Search results and ads for "support"

When people search for help with a printer, an e-mail account or a bank app, fake support numbers sometimes appear in ads or on look-alike help pages. Always get support contacts from the company's own website, typed in yourself.

What happens on the call

The script is remarkably consistent:

1. They ask you to install a remote access tool so they can "take a look". Remote access software is legitimate, which is why it's so useful to them.
2. They show you "proof". Normal system logs or warnings are presented as signs of infection.
3. They sell you a fix: a "security package", a "lifetime licence" or a "network firewall", often for hundreds.
4. They ask for payment by gift card, crypto or bank transfer, or ask you to log in to your online banking "to process the refund".

A common variation is the refund scam: they say you're owed a refund, ask you to log in to your bank while they're connected, then secretly change the amount so it looks like they've refunded too much. They ask you to "send back the difference". In reality, they moved your own money between your accounts, and what you send back is real.

Warning signs

• A pop-up or caller tells you to call a phone number to fix a virus.
• You're told not to turn off your computer or not to tell anyone, including your bank.
• They want remote access to your computer.
• They ask you to log in to online banking while they're connected.
• They want payment in gift cards or crypto.
• They say you'll be arrested, fined or lose your data if you don't act now.

How to close a fake warning

1. Don't call the number and don't click anything inside the page.
2. Close the browser tab or the browser. On Windows, press Ctrl + Shift + Esc to open Task Manager and end the browser task if the page won't close. On a Mac, press Command + Option + Esc and force-quit the browser.
3. When you reopen the browser, don't restore the previous tabs if it offers to.
4. If you want reassurance, run a scan with the security software already installed on your computer.

If you want to know what kind of site you landed on, copy its address before closing it and check it on websurely.com. Many fake warning pages sit on throwaway addresses that are only a few days old or already appear in the security databases we check.

If you've already let them in

Don't feel foolish. These callers do this all day and are very good at it. Act now:

1. Disconnect the computer from the internet: unplug the network cable or turn off Wi-Fi. This ends the remote session.
2. Call your bank using the number on your card or the back of your bank statement. Tell them someone had remote access to your computer, and whether you logged in to your banking or made payments during the call.
3. Remove the remote access program they had you install. If you aren't sure which one it was, get help from a trusted local computer shop.
4. Run a full security scan.
5. Change your passwords from a different device, starting with e-mail and online banking. Turn on two-step verification.
6. If you paid with a gift card, contact the company that issued the card immediately with the card numbers; sometimes unused balances can be frozen.
7. Report it. See below.

For a complete checklist, read What to do if you've been scammed online. For card disputes and bank recalls, see How to get your money back.

Where to report tech support scams

• US: the FTC at reportfraud.ftc.gov and the FBI at ic3.gov
• UK: Action Fraud at actionfraud.police.uk
• Germany: your local police or your federal state's online police station; the BSI (Federal Office for Information Security) publishes advice on fake support calls
• Canada: the Canadian Anti-Fraud Centre
• Australia: Scamwatch
• The company being impersonated: Microsoft, Apple and others have pages for reporting tech support scams

Report the website too. Submit it on websurely.com so other visitors see a warning, and see How to report a scam website for browser and hosting reports.

Protecting the people around you

Tech support scams often target older people, but anyone can be caught off guard by a loud, full-screen warning. A few rules worth sharing with parents and grandparents:

• "A real virus warning never shows a phone number."
• "Microsoft and Apple won't call you."
• "Never let a stranger onto your computer."
• "If something scary pops up, close the browser and call me."

You can also install the free websurely.com browser extension on their computer. It shows a coloured risk badge for every site, and you can switch on an optional warning banner for high-risk pages, which gives a clear signal when something is wrong. It's also worth reading our guide to spotting phishing websites, since fake support pages and fake login pages often go together.

Check a website now

Landed on a strange warning page? Close it, then check the address on websurely.com to see what it really was.