Fake Microsoft support calls: how the scam works
A caller using Microsoft’s name to get onto your computer, and how the call plays out.
Microsoft doesn’t phone people about problems with their computers. So if someone calls saying they’re from Microsoft, Windows or “the Windows technical department” and wants to connect to your PC, it isn’t Microsoft. Hang up.
That’s the short version. The longer one is worth knowing, because these calls are very good at seeming real while you’re on them.
How it starts
Most of these scams start in one of two ways: someone calls you out of the blue, or a warning fills your screen and tells you to call a number. If you’re looking at a warning like that right now, don’t call. Follow what to do about a fake Microsoft pop-up instead. This guide is about the call, however it began.
The phone call
The other version starts with a call. The caller says they’re from Microsoft, Windows, “the Windows technical department” or your internet provider. Your computer has been sending them error reports, or it’s been hacked and is attacking other computers. They offer to prove it.
What they show you to prove it
They might ask you to open Event Viewer, which lists warnings and errors. Every Windows computer has hundreds of those, and they’re normal. Or they’ll have you type a command that fills the screen with file names and tell you that’s the virus. Then they ask to connect so they can fix it.
What happens if you let them in
Usually one of three things. They charge you for a fake repair or a “lifetime security plan”, often a few hundred dollars. They tell you your bank account has been compromised and walk you through moving your money. Or they say you’re owed a refund, then claim they refunded too much and ask for the difference back in gift cards or by wire.
If you refuse to pay, some get angry or threatening. That’s your cue to hang up and turn off the internet.
How to tell it’s fake
- “Microsoft” contacted you first. It doesn’t do that for support.
- They want remote access to fix something they say they spotted remotely.
- They show you normal Windows screens, like Event Viewer, as proof that something is wrong.
- They’re in a hurry and don’t want you to hang up or call anyone else.
- They want payment by gift card, crypto, wire or courier.
What to say, and if they call back
You don’t need to argue or explain. Say “I don’t let anyone connect to my computer. I’ll contact Microsoft myself,” and hang up. If they keep talking, hang up anyway. That isn’t rude; it’s exactly what Microsoft tells people to do.
Some callers ring back several times, sometimes from a different number. The caller ID can be faked to show “Microsoft”, a local number or even your bank, so it proves nothing (the FTC explains how caller ID is faked). Don’t pick up numbers you don’t know, and block the ones they used. If you’re looking after a parent, tell them the same script, and that it’s fine to hang up on anyone who asks to connect.
If you already called or let them connect
Turn off the PC’s internet and hang up. Call your bank from another phone if you paid anything, signed in to your bank, or gave out card details. Then check the PC for the remote tool they used, usually AnyDesk, TeamViewer, ScreenConnect or Quick Assist. Our step-by-step check shows where to look.
You can report it to Microsoft at microsoft.com/reportascam, and in the US to the FTC at ReportFraud.ftc.gov.
If you need real Microsoft support
Start at support.microsoft.com, or open the Get Help app that comes with Windows. Don’t search for “Microsoft support phone number” and call whatever comes up first. Some of those results are ads placed by the same people.
Where Guardian helps
Even when someone believes the caller, Xcelcor Guardian stops the connection from opening just because they said so. Every new remote connection waits for approval from the account holder, by email or on our website, and the PC itself only has a Refuse button. If you look after a parent’s computer, that approval comes to you.
Last updated