How the Microsoft Tech Support Scam Call and Pop-Up Really Work

The phone rings just after lunch. A calm voice says, "Hello, this is Kevin from Microsoft Security. We have detected unusual activity coming from your computer." Or maybe there is no call at all. Your screen turns red, an alarm starts blaring, and a message says your computer is infected and you must call Microsoft right now. Either way, the next twenty minutes can cost you thousands of dollars. This is the Microsoft tech support scam, and it is one of the most common frauds aimed at Americans, especially people over 60.

Tech support scams are among the frauds that hit older Americans hardest, and fake Microsoft support is one of the most familiar versions. The callers change their names, their numbers and their stories, but the playbook barely changes at all. Once you have seen it laid out, you will recognize it at the first sentence instead of the fortieth.

This guide brings together everything we know about the scam in one place. It explains how the call and the pop-up work, what the scammers say at each step, the warning signs, and exactly what to do if you already gave someone access to your computer or sent money.

What is a Microsoft tech support scam?

A Microsoft tech support scam is a fraud where criminals pretend to work for Microsoft, or for a company connected to your computer, and convince you that your device has a serious problem. They then "fix" a problem that does not exist and charge you for it, steal your banking details, or take money straight out of your accounts while they have control of your screen.

The scammers do not need to hack anything. They rely on fear, urgency and a basic trust in big brand names. Microsoft is the most common name they use because almost every home computer runs Windows, but the same script also appears under the names Apple, Norton, McAfee, Geek Squad, Windows Security, Amazon and internet providers. The brand changes. The method does not.

Microsoft itself is clear about this. On its official security page, the company says it never makes unsolicited phone calls or sends unsolicited emails asking for personal or financial information, and that it does not proactively reach out about computer problems. You can read that warning directly on Microsoft's support site. That single fact is enough to end most of these calls.

How big is the problem?

Tech support fraud is not a small nuisance. Federal agencies treat it as one of the biggest drivers of losses among older Americans, and the numbers keep rising.

The FTC laid out those older adult figures in its December 2025 report to Congress. In late 2024 the agency also changed the Telemarketing Sales Rule so that it covers calls people make to fake support lines, not just calls they receive. That change exists because the pop-up version of this scam has become so common.

Keep in mind that these are only reported losses. The FTC has said many times that most fraud is never reported, often because victims feel embarrassed. The real total is far higher than any official chart.

The two ways the scam reaches you

Door 1: The cold call

Someone calls you out of the blue. They say they are from Microsoft, Windows Security, your internet company or a well known antivirus brand. They claim your computer has been sending error reports, that hackers are on your network, or that your IP address has been used for something illegal. The tone is calm, professional and slightly worried, like a real support agent who wants to help you before something bad happens.

Caller ID often shows a local number, a toll free number, or even a real Microsoft number. That means nothing. Caller ID spoofing lets scammers display almost any number they want, including your own area code. If a number called you about a computer problem, you can look it up in our free robocall checker to see whether other people have reported it.

Door 2: The pop-up you call yourself

This version is now more common, and it is more dangerous because you make the call. While you are reading the news or checking email, the browser suddenly fills the screen with a warning. It may say "Windows Defender Alert," "Your computer is locked," or "Do not restart your computer." An alarm or robotic voice may play. A countdown may claim your files will be deleted. And there is always a phone number in big letters.

Because you dialed, it does not feel like a scam. That is exactly the point. Your computer is not locked and nothing is being deleted. It is just a web page running a script that opens windows faster than you can close them. Our guide on closing a fake virus warning with two keys shows you how to shut it down in seconds.

The script, step by step

Whether it starts with a call or a pop-up, the conversation follows a fixed order. Knowing that order lets you spot the scam early and hang up before anything is lost.

Step 1: The friendly opening

The scammer gives a name, a company and sometimes an employee ID number. The voice is polite and patient. There are no threats yet. They have practiced sounding like a real support agent hundreds of times, and many work from scripted call centers with supervisors listening in.

Step 2: The scary claim

Next comes the problem. Hackers are using your network. Someone is logging into your online banking. Your Social Security number has been exposed. Your computer is infected with a virus that is spreading to other devices. These claims are delivered quickly, one after another, so you never get time to check any of them.

Step 3: "Are you near your computer?"

This question is the hinge of the whole scam. Everything before it was setup. Everything after it is the actual theft. If you say yes, they will walk you through the next step slowly and kindly.

Step 4: The remote access request

They ask you to go to a website and type in a code, or to download a "support tool." The names often sound familiar because they are real: AnyDesk, TeamViewer, LogMeIn, UltraViewer, ConnectWise and similar tools. Businesses use them every day. In a scammer's hands, they hand over full control of your screen, mouse and files.

Step 5: The fake proof

Once inside, they open a built in Windows tool such as Event Viewer, or they run a command that fills the screen with scrolling technical text. Every normal computer shows warnings and errors in Event Viewer. The scammer points at them and says, "See? These are all the hackers." It looks convincing if you have never opened that screen before.

Step 6: The bill or the bank move

Now money comes up. Sometimes it is a "security package" for a few hundred dollars, or a "lifetime protection plan" for much more. Sometimes they say your bank account is compromised and you must move your savings to a "safe account" they control. Sometimes they claim to give you a refund, then say they accidentally sent too much and ask you to send the difference back. Every one of these ends with your money in their hands.

A typical case, start to finish

Here is how a common version plays out, based on the patterns described by the FTC, Microsoft and the reports our readers send us. The details are typical rather than taken from one single victim.

A retired teacher in her late sixties is reading a recipe site when her screen turns red and a voice says her computer has a dangerous virus. The message shows a "Microsoft Support" number. She calls. A friendly man named "David" says he can see the infection and asks her to download a support app so he can clean it. She agrees.

David opens a screen full of warnings and tells her the hackers have also reached her bank. He asks her to log into her online banking "so we can check the damage." While she is logged in, he says Microsoft will refund her $300 for the trouble. A moment later he says, in a panic, that he accidentally typed $30,000. He shows her what looks like her balance with an extra $30,000 in it. In reality, he has simply moved money between her own savings and checking accounts, or edited the page on screen.

David begs her to send the "extra" back so he does not lose his job. The bank will not let her wire that much, so he tells her to buy gift cards, or to take cash to a crypto ATM, or to hand an envelope of cash to a courier who will come to her door. She sends thousands before her son finds out. The money is gone.

Every piece of that story is designed to make her feel responsible, rushed and alone. That is the pattern to remember, not the specific numbers.

Why careful people still fall for it

It is easy to assume only people who "do not understand computers" lose money this way. That is wrong, and believing it makes you less careful. Engineers, nurses, accountants and retired business owners all report these losses. The real reasons are about habits and pressure, not intelligence.

Older adults answer the phone. Many younger people let unknown numbers ring out. Answering is the first step of the scam.

Politeness is a habit. Hanging up mid sentence on someone who sounds helpful feels rude. Scammers count on that hesitation.

A phone call used to mean something. For decades, businesses and doctors really did call customers. That instinct to take a call seriously is now being used against people.

Fear shuts down careful thinking. An alarm, a countdown and words like "hackers" and "bank account" push anyone into fight or flight mode. In that state, people follow instructions instead of questioning them.

The fake proof looks real. Windows really does keep logs full of warnings. When a stranger shows you those logs, it feels like evidence.

If this happened to you or someone you love, it is not a sign of weakness. It is a sign that a professional criminal operation did what it was built to do.

Red flags that give it away

If you see even one of these, stop and hang up. You do not need to be sure it is a scam before ending the call.

• Microsoft called you first. Microsoft does not make unsolicited calls about your computer. Neither do Apple, Norton or McAfee.
• A pop-up shows a phone number. Real security warnings never ask you to call anyone.
• You hear an alarm or countdown. A web page cannot delete your files. The noise is there only to scare you.
• They ask, "Are you near your computer?" This is the setup for remote access.
• They want you to install AnyDesk, TeamViewer or a similar app. Never install anything during a call you did not expect.
• They ask you to log into your bank. Tech support never needs to see your bank account.
• They mention a refund you did not request. The "refund mistake" story is one of the most common ways people lose large sums.
• They want gift cards, crypto, wires or cash. No real company takes these for support.
• They tell you to keep it secret. Real companies never ask you to hide anything from your family or your bank.

Real Microsoft support vs the scam

The payment demand gives it away every time

Watch closely what happens when money comes up. A real company takes a card, sends a receipt and can be called back on a number you find yourself. A scammer asks for one of these instead:

• Gift cards, with the numbers read out over the phone while you stay on the line
• A wire transfer to a person or "partner company"
• Cryptocurrency, often through a Bitcoin ATM at a gas station or convenience store
• A payment app such as Zelle or Cash App
• Cash handed to a courier at your door or mailed in a package

All of these share one feature: once the money leaves, it is very hard or impossible to get back. That is the only reason scammers use them. No legitimate technology company has ever asked to be paid for support with a gift card. If you are told to keep the cashier from knowing what the cards are for, that is another clear sign.

Some scams go further and pull in fake bank fraud departments, fake government agents or fake police officers to add pressure. We cover that bank side of the scheme in our guide to tech support scams that empty bank accounts.

How to protect yourself and your family

You do not need technical skills to stay safe. A few fixed habits stop almost every version of this scam.

1. Never call a number shown in a pop-up. Close the browser instead. On Windows, press Ctrl, Shift and Esc to open Task Manager and end the browser. On a Mac, press Command, Option and Esc.
2. Hang up on any unexpected tech support call. Say, "I will call the company myself," and end the call. Then find the real number on your own paperwork or by typing the company's web address yourself.
3. Make one fixed rule: no installing anything during a call you did not start. A fixed rule means you never have to judge each situation under pressure.
4. Never log into your bank while a stranger can see your screen. No tech problem requires it.
5. Keep Windows and your browser updated. Turn on automatic updates and use the built in Microsoft Defender protection. This blocks many fake pop-up sites before they load.
6. Use a pop-up blocker and do not click on ads that look like warnings. Many fake alerts come from ads on otherwise normal websites.
7. Agree on a family code. Decide that any call about a computer problem ends with "I will call you back," and that you will check with a family member first. Our free printable scam safety card is an easy reminder to keep by the phone.

Already let them in or paid? Do this now

If you already gave someone access to your computer or sent money, act quickly and calmly. Speed matters most in the first two steps.

1. Disconnect from the internet. Unplug the network cable or turn off Wi-Fi. This cuts their remote session immediately.
2. Call your bank and card issuers. Use the number on the back of your card, ideally from a different phone. Say a remote access scam happened and ask them to freeze transfers and review recent activity.
3. Change your passwords from a different device. Start with your email, because email is the key to resetting everything else. Then change banking, shopping and social media passwords, and turn on two step verification.
4. Remove the remote access software. Uninstall AnyDesk, TeamViewer or whatever you were told to install. If you are unsure, take the computer to a local technician you found yourself.
5. If you paid with gift cards, call the card company right away. Report the card numbers and ask whether any balance can be frozen. Keep the cards and receipts.
6. If you used a crypto ATM or wire, contact the operator or your bank immediately and ask them to try to stop the transfer.
7. Report it. File with the FTC at ReportFraud.ftc.gov and with the FBI at IC3.gov. Include phone numbers, websites, payment details and times.
8. Watch your credit. If you shared your Social Security number, place a fraud alert or credit freeze with Equifax, Experian and TransUnion, and visit IdentityTheft.gov.

If you are 60 or older, the National Elder Fraud Hotline at 1-833-FRAUD-11 (1-833-372-8311) can help you report and plan next steps. Our step by step guide for the first 48 hours after a scam and our fraud help resources page list more official contacts.

The refund scam and the recovery scam

Tech support criminals often come back for a second round. Months after the first loss, the victim gets a call from a "refund department" saying the support company went out of business and owes them money. To process the refund, they need remote access again. It is the same gang, or a group that bought the victim list.

Others pose as lawyers, "crypto tracing" firms or even federal agents who promise to recover your money for a fee. The FBI has warned that criminals impersonate FBI staff who handle IC3 complaints, and that IC3 does not contact victims to recover funds. We explain this pattern in our guide to recovery scams that target past victims.

How to talk to a parent about this

The most useful thing you can give an older relative is not a lecture. It is permission. Tell them directly that hanging up on a stranger is always allowed, and that you would rather they hang up on a real company by mistake than stay polite with a criminal.

Then agree on one simple habit: any call or pop-up about a computer problem gets ended, and they call you instead. No judgment, no questions about whether it was really a scam. Just call. Our tech support scam guide for seniors has more tips written for older readers and the people who help them.

Shame is what keeps these losses hidden. If a parent does get caught, focus on the next steps above, not on blame. The faster they tell someone, the better the chance of stopping a payment.

Frequently asked questions

How we researched this article

This guide is based on official guidance and data from the Federal Trade Commission, Microsoft, and the FBI's Internet Crime Complaint Center, along with scam reports submitted by our readers. Every statistic links to its original source. We do not accept payment from any company mentioned here. If you spot an error or have new information about this scam, please email [email protected] and we will review it under our fact checking policy.

This article is for general consumer education and is not legal or financial advice. If you have lost money, contact your bank, the FTC and the FBI, and consider speaking with a licensed attorney in your state.