That "Microsoft Support" Call? Here's What They're Really After

You're browsing the internet when suddenly a full-screen pop-up appears. A loud alarm sounds. Bold red text warns: "YOUR COMPUTER HAS BEEN COMPROMISED. DO NOT TURN OFF YOUR PC. Call Microsoft Support immediately: 1-800-XXX-XXXX."

Your heart rate jumps. Is your computer really infected? Should you call that number?

Here's the truth: that pop-up is fake. There is no virus. Microsoft did not send it. And that phone number connects to a scammer in a call center overseas who has one goal — to get remote access to your computer and your financial accounts.

The Two Ways This Scam Starts

Version 1: The Pop-Up

While browsing a website — sometimes a completely normal one that has been compromised by ad networks — a full-screen alert hijacks your browser. It may play an audio alarm, display flashing text, or even lock your mouse. The message claims your computer has detected a virus, malware, or that your Microsoft license has expired. It provides a phone number to call "immediately."

This is not a real system alert. Your operating system (Windows, Mac, or otherwise) never communicates security warnings through your web browser. If you see one, close the browser tab. If you can't close it, restart your computer.

Version 2: The Unsolicited Call

You receive a phone call — often from someone with a professional-sounding name, an American accent, or a spoofed number that appears to be from Microsoft, Apple, or Google. They tell you that their "systems have detected unusual activity" on your device and they need remote access to diagnose the problem.

Neither Microsoft, Apple, Google, nor any legitimate technology company will call you out of the blue about a problem on your computer. This is not how technical support works. It never has been.

The Script They Use (Word for Word)

Understanding exactly what these scammers say — before it happens to you — is one of the most powerful things you can do. Here's how a typical tech support scam call unfolds:

Once you download that "support tool," you have given them full remote access to everything on your computer — including saved passwords, bank login credentials, and personal documents.

What Happens After Remote Access is Granted

Once a scammer has remote access to your computer, the possibilities for fraud escalate rapidly:

• They open your bank account. If you have banking passwords saved in your browser, they can access and drain accounts in minutes.
• They install tracking software. Keyloggers record everything you type — including passwords you enter after they "fix" the problem — for weeks or months.
• The "overpayment" scam. A common follow-up: they claim to have accidentally refunded you too much for their services. They ask you to go to the bank and wire the "excess" back. There is no refund — they're stealing directly.
• They charge you for their "help." After "fixing" the non-existent problem, they charge $200–$500 using your stored payment details.

Warning Signs: How to Spot It Immediately

Exactly What to Do

1. For a browser pop-up: Do not call the number. Press Ctrl+W (Windows) or Cmd+W (Mac) to close the tab. If the browser is frozen, force-quit it from your taskbar. Then restart your computer normally — there is no virus.
2. For an unsolicited call: Hang up. Do not press any keys, do not "speak to a manager," do not ask questions. Just hang up.
3. If you already gave remote access: Disconnect your computer from the internet immediately (unplug your ethernet cable or turn off Wi-Fi). Change all passwords for your financial accounts from a different device. Contact your bank.
4. If you gave payment information: Call your bank and credit card company immediately to report potential fraud and consider placing a freeze on your credit.
5. Report it: File a complaint at ReportFraud.ftc.gov. Your report helps investigators track and shut down these operations.

Frequently Asked Questions

Can a website really lock my computer screen?

Some browser pop-ups are designed to make it difficult to close the window, which can feel like your computer is locked. It isn't. Pressing Ctrl+Alt+Delete (Windows) or using Force Quit (Mac) will close the browser and return full control to you.

What if the caller knew my name or address?

This information is widely available through data broker websites and public records. Scammers purchase databases of personal information to make their calls seem more credible. Knowing your name is not proof that someone works for a technology company.

Microsoft emailed me about a security issue — is that real?

Be cautious with any unsolicited email claiming to be from a technology company. Check the sender's actual email domain carefully (not just the display name). Legitimate emails from Microsoft come from microsoft.com domains. When in doubt, go directly to Microsoft's website by typing microsoft.com in your browser — do not click links in the email.