Tech support scams: how to spot them and what to do
Tech support scams don't rely on clever hacking. They rely on worry and urgency. Someone tells you there's a problem, makes it sound serious, then offers to fix it. People who get caught aren't foolish. The scripts are practised and the callers can be patient and friendly. I see the aftermath often enough in remote sessions that it's worth setting out the patterns.
Written by Adam CurtisPublished Last updated
The fake Microsoft, Telstra or NBN call
The phone rings and someone says they're from Microsoft, Telstra, NBN Co or a vague “technical department”. They say your computer is sending errors, has been hacked, or your internet is about to be disconnected.
They ask you to go to a website and install a program so they can check. Once they're connected, they often open normal system screens and claim the ordinary entries there are proof of infection.
The rule is simple: hang up. If you're genuinely worried about your internet service, ring your provider on the number on your bill, not a number the caller gives you.
Pop-up warnings that take over your browser
A full-screen message says your computer is infected, sometimes with a loud alarm or a recorded voice, and tells you to call a number immediately. It may use Microsoft or Apple logos to look official.
These are just web pages. Windows and macOS don't put a phone number on screen for you to ring when they find a problem. Here's what to do instead:
- 1Don't call the number, and don't click anything inside the pop-up.
- 2Close the browser. On Windows, if it won't close, press Ctrl + Shift + Esc to open Task Manager and end the browser. On a Mac, press Command + Option + Esc and force quit it.
- 3When you open the browser again, don't restore the previous tabs.
- 4If the warning keeps coming back, it may be a browser notification or extension, which is worth having looked at.
Refund scams
This one often follows an earlier contact. Someone says you're owed a refund, for a cancelled subscription, an overcharge or a previous support service. To process it, they need to connect to your computer and have you log in to your online banking.
They then make it look as though too much was refunded, often by editing what's shown on your screen, and ask you to send the extra back by bank transfer, gift cards or cryptocurrency. No refund ever happened. The money you send is your own.
A real refund never needs you to open your banking while someone watches, and never needs you to send money back.
What to do if you've been caught
If you've let a scammer connect, or given them details, act quickly. This isn't the moment to feel embarrassed. Work through these in order:
- 1Disconnect the computer from the internet. Unplug the network cable or turn off Wi-Fi.
- 2Call your bank straight away, using the number on the back of your card. Tell them what happened and ask them to protect your accounts.
- 3From a different device you trust, change your email password first, then banking and any other accounts that share that password.
- 4Turn on multi-factor authentication for your email if it isn't already on.
- 5Have the computer checked for remote access software and other changes before using it for banking again.
If your email might have been accessed, my guide on how to tell if your email has been hacked has a recovery checklist. For help checking the computer and removing unwanted remote access programs, see computer security help, and if the scammer had your mailbox, email support can help lock it down.
How to report a tech support scam
Reporting helps even if you didn't lose money, because it helps authorities warn others. Depending on what happened:
- Scamwatch (opens in a new tab), run by the ACCC, to report the scam and see current warnings.
- ReportCyber (opens in a new tab), through the Australian Cyber Security Centre, if you've lost money or had accounts or devices compromised.
- Your bank, as early as possible, if money or card details are involved.
- IDCARE, a not-for-profit identity and cyber support service, if identity documents or personal details were shared.
How to tell a real technician from a scammer
It usually comes down to who made contact. Scammers come to you. With legitimate support, you go to them. With me, you send a request, I reply by email, and you start the session at a booked time by approving a link.
There's more on that in my guide to whether remote computer support is safe and on the how remote support works page.
Common questions
Will Microsoft ever call me about a virus on my computer?
Microsoft says it doesn't make unsolicited calls offering tech support or warning about viruses. If someone rings claiming to be Microsoft and says your computer has a problem, hang up. The same goes for calls claiming to be Telstra or NBN Co.
I let a scammer connect but didn't pay anything. Do I still need to act?
Yes. They may have installed software that lets them reconnect later, or seen saved passwords. Disconnect from the internet, change your email password from another device, tell your bank, and have the computer checked before using it for banking again.
Can my bank get my money back?
It depends on the bank and what happened, so I can't promise an outcome. What helps most is contacting them quickly. The sooner they know, the more options they usually have to stop or trace a payment.
Is it safe to keep using my computer after a scam?
Not for banking or anything sensitive until it's been checked. Scammers often leave remote access software or change settings. A check looks for those programs, unusual startup items and browser changes, and removes anything that shouldn't be there.