The Tech Support Call That Is Really a Scam

A warning that asks you to call

October is Cyber Security Awareness Month, and one of the commonest attacks on small offices needs no technical skill at all. It needs a telephone.

Sometimes a caller claims to be from a well-known software company or your internet provider, and says they have detected a problem on your computer.

Sometimes a web page suddenly fills the screen with a warning, a recorded voice and a number to call.

Both routes end the same way: someone lets a stranger control the computer, then pays for a repair it never needed.

The people caught are not careless. The scam is built to sound like real support, and it reaches whoever happens to be nearest the phone.

How the scam usually runs

• The alarm: a call or a full-screen warning, often with a recorded voice.
• The proof: a log of routine errors presented as signs of infection.
• The remote session: a program installed so the caller can take control.
• The repair: a show of scanning and deleting, sometimes doing real harm.
• The bill: a support plan paid by card, transfer or gift cards.
• The return call, weeks later, offering a refund that needs remote access again.

The third is the step that turns a nuisance into a real problem. Once a stranger has controlled the computer, anything stored or typed on it may have been seen, and anything could have been left behind.

Why the pop-up is convincing

The warning page usually arrives through a mistyped address, a bad advert or a link in an email. It fills the screen, sounds an alarm and copies the look of a genuine system message.

Some pages open box after box, so the browser seems frozen. Many claim the computer will be locked or its files deleted unless someone calls within minutes.

It is still only a web page. It cannot see the computer or detect anything on it; its whole purpose is to get a phone call.

What real companies do not do

Software makers do not phone customers to report viruses. They do not watch individual computers for infections, and they would not ring you about one if they did.

Internet providers rarely call about a single computer. When they genuinely do, they will not mind you hanging up and calling back on the number printed on your bill.

A genuine warning from the operating system or an antivirus program never includes a phone number to call. And no legitimate company asks to be paid in gift cards.

Closing the pop-up

Do not call the number, and do not click anything inside the warning, including its own close buttons.

Close the browser instead. If it will not close, force it to quit or restart the computer. When the browser reopens, decline any offer to restore the previous pages, since that brings the warning straight back.

Then run a full antivirus scan. The page usually leaves nothing behind, but checking takes minutes.

A worked example

A lumber yard with a contractor counter and a small retail showroom shares one computer behind the counter for stock lookups and printing quotes.

A staff member looking up a deck stain's coverage clicked a search result, and the screen filled with a red warning, a voice saying the computer was infected, and a number to call.

She called. A calm, professional voice talked her through installing a remote access program, then showed her a screen full of errors.

The fix cost a few hundred dollars, charged to the yard's company card, for a year of protection.

Nobody had ever told the counter staff what a real warning looks like, or who actually looks after the yard's computers. The scam filled that gap.

That afternoon the owner called the card company, unplugged the computer from the network and had the yard's usual technician remove the program. Passwords were changed from another computer, and a note went up by the counter phone.

If someone was let in

Disconnect the computer from the internet at once: unplug the network cable or turn off the wireless connection. That ends the remote session.

Then have your own technician or IT provider check the computer before anyone uses it again, since remote access programs can be left running and other software may have been added.

Where there is doubt, wiping the computer and reinstalling is cheaper than wondering. Restore the business's files from a backup made before the call, not from the computer itself.

Passwords and payments afterwards

Assume anything typed or saved on that computer was seen. From a different computer or phone, change the passwords for online banking, email, the website's admin login, the domain registrar, supplier portals and social media accounts.

If a card was used, call the card company the same day and explain what happened. If money left a bank account, call the bank.

Watch statements for the next few months, because card details given to a scammer can be used again.

Expect a second call within weeks, offering a refund that needs remote access to process. It is the same scam again, so warn everyone who answers the phone.

A rule staff can remember

Write one sentence and put it beside every phone and computer: we never let anyone into our computers unless we called them first.

Add the name and number of whoever really looks after the computers, so staff know who a genuine call would come from.

And make it safe to report a mistake. A staff member who admits calling a number within minutes saves far more than one who stays quiet out of embarrassment.

The counter-case

Not every unexpected call about a computer is a scam. Your own IT provider may phone about something they have spotted, and a bank's fraud team may call about a card.

The test for both costs a minute: hang up and call back on a number you already have, from the contract, the card or the bill. Real support survives that check every time.

Let nobody into a computer unless you called them, and call back on a known number whenever in doubt.

This month

1. Tell staff real companies never call about viruses.
2. Post the rule beside every phone.
3. Name the person who looks after the computers.
4. Close warnings by closing the browser.
5. Disconnect any computer a stranger has controlled.
6. Change passwords from a different device.
7. Call the card company the same day.

Step three is the one that stops the call from working. Staff who know exactly who looks after their computers have a reason to doubt anyone else who claims to.

Passwords changed after a call hold up better with a second step behind them, as covered in two-step verification on the domain registrar account.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.