Fake Microsoft support scams
A pop-up or a caller using Microsoft’s name to get onto your computer.
Microsoft doesn’t phone people about problems with their computers, and it doesn’t put phone numbers in its error messages. So if a call or a pop-up says it’s Microsoft and wants you to ring a number or let someone connect, it isn’t Microsoft.
That’s the short version. The longer one is still worth knowing, because these scams are very good at seeming real while you’re looking at them.
The pop-up
You’re reading a news site or clicking a search result, and the screen fills with a warning. It might look like Windows Security, or a blue error screen. Often a loud voice or alarm keeps repeating that your computer is locked, your data is being stolen, and you must call Microsoft Support on the number shown. Sometimes the mouse seems to stop working, or the page won’t close.
Your computer isn’t locked. It’s a web page that has gone full screen and is playing a sound. Nothing has been installed and nobody is connected.
How to close it
- Press Esc to leave full screen, then try closing the tab.
- If it won’t close, press Ctrl + Shift + Esc to open Task Manager, select your browser (Edge, Chrome or Firefox) and click End task.
- When you open the browser again, don’t let it restore your previous tabs, or the page will come straight back.
That’s all. If you didn’t call the number or install anything, there’s nothing to clean up. Clear your browsing history and run a quick scan in Windows Security if it makes you feel better, but the pop-up itself didn’t do anything to your PC.
If the pop-ups keep coming back
These pages usually come from a bad ad on an ordinary website, or from mistyping a web address. If you see them again and again, check whether a website has been allowed to send you notifications. Those appear in the corner of the screen even when the site isn’t open. In Edge or Chrome, open Settings, then the site permissions or privacy section, then Notifications, and remove any site you don’t recognize. Then look through your browser’s extensions and remove any you didn’t add.
The phone call
The other version starts with a call. The caller says they’re from Microsoft, Windows, “the Windows technical department” or your internet provider. Your computer has been sending them error reports, or it’s been hacked and is attacking other computers. They offer to prove it.
They might ask you to open Event Viewer, which lists warnings and errors. Every Windows computer has hundreds of those, and they’re normal. Or they’ll have you type a command that fills the screen with file names and tell you that’s the virus. Then they ask to connect so they can fix it.
What happens if you let them in
Usually one of three things. They charge you for a fake repair or a “lifetime security plan”, often a few hundred dollars. They tell you your bank account has been compromised and walk you through moving your money. Or they say you’re owed a refund, then claim they refunded too much and ask for the difference back in gift cards or by wire.
If you refuse to pay, some get angry or threatening. That’s your cue to hang up and turn off the internet.
How to tell it’s fake
- “Microsoft” contacted you first. It doesn’t do that for support.
- The warning shows a phone number. Real Windows errors don’t.
- They want remote access to fix something they say they spotted remotely.
- They’re in a hurry and don’t want you to hang up.
- They want payment by gift card, crypto, wire or courier.
If you already called or let them connect
Turn off the PC’s internet and hang up. Call your bank from another phone if you paid anything, signed in to your bank, or gave out card details. Then check the PC for the remote tool they used, usually AnyDesk, TeamViewer, ScreenConnect or Quick Assist. Our step-by-step check shows where to look.
You can report it to Microsoft at microsoft.com/reportascam, and in the US to the FTC at ReportFraud.ftc.gov.
If you need real Microsoft support
Start at support.microsoft.com, or open the Get Help app that comes with Windows. Don’t search for “Microsoft support phone number” and call whatever comes up first. Some of those results are ads placed by the same people.
Where Guardian helps
Even when someone believes the caller, Xcelcor Guardian stops the connection from opening just because they said so. Every new remote connection waits for approval from the account holder, by email or on our website, and the PC itself only has a Refuse button. If you look after a parent’s computer, that approval comes to you.
Last updated