Tech support fraud persists because it inverts the usual dynamic: the victim believes they are being helped, and frequently initiates the call themselves. That makes it feel voluntary in a way that suppresses suspicion until money or access has already changed hands.

How it starts

  • A full-screen browser page claiming infection, often with alarm sounds and a support number. It is a web page, not your operating system.
  • A cold call claiming to be from a well-known software or telecoms company about a problem with your device.
  • A search advertisement above the genuine support result for a company you were actually trying to reach.
  • A pop-up after a legitimate-seeming download or an expired-subscription notice.

What happens on the call

The caller asks you to install remote-access software — legitimate tools like AnyDesk or TeamViewer, used against you. They then show you ordinary system output reframed as evidence of infection: event viewer warnings, routine network connections, standard background processes. With access established, they may install genuine malware, harvest saved credentials, or open your banking site and manipulate what you see.

The refund variant, which causes the largest losses

Some months later a caller claims you are owed a refund. They take remote control while you log into your bank, use browser tools to make it appear that an excessive refund was deposited, then ask you to return the difference. The deposit never existed; the money you send is yours. This variant produces some of the largest individual losses we see, because the victim believes they are correcting an error honestly.

The rules that end it

  • A genuine security warning never provides a phone number to call.
  • Microsoft, Apple, and your ISP do not cold-call about infections on your device.
  • Never grant remote access to anyone who contacted you first, regardless of what they show you.
  • Reach support by typing the company's address yourself, never via a search advertisement or pop-up.

If you granted access

Disconnect the device from the internet, then from a different clean device change passwords starting with email, followed by banking. Revoke active sessions and check for mailbox forwarding rules. Remove any remote-access software installed, and consider a full rebuild of the device if banking was accessed during the session. Contact your bank directly to flag the account.