What To Do After a Fake Microsoft Support Scam

Do these first

1. 1

   End the session and disconnect

   If someone is connected right now, close the remote software or simply turn the computer off. Unplug the network cable or switch off Wi-Fi. Ending the connection matters more than shutting down gracefully.

2. 2

   Stop communicating

   Hang up. Do not call back to "cancel the refund", do not reply to follow-up calls or emails, and expect them to try again — often claiming to be a different company offering to recover your money.

3. 3

   Send no further money

   No legitimate company asks for gift cards, wire transfers, cryptocurrency or bank transfers to fix a computer problem. A request to move money "to protect it" is always part of the scam.

4. 4

   Move to a device you trust

   Use a phone or another computer that was not part of the session for everything in the next section. Do not use the affected machine to change passwords.

5. 5

   Call your bank if money or banking was involved

   If you paid, shared card details, or they were shown your online banking, contact your bank or card issuer immediately and tell them what happened. Speed matters for reversing transactions.

What actually happened

These scams follow a familiar script: a full-screen warning claiming Windows is infected with a number to call, or a cold call claiming to be Microsoft or your internet provider. The caller asks you to install a remote-support program, shows you routine system logs presented as evidence of infection, then quotes a price for a "fix".

Microsoft does not call people about virus infections, and no legitimate warning message includes a phone number to call. Once they have remote access, what happens next varies — that is why the honest answer to "is my computer infected?" is that it depends on what they did while they were connected.

• Often: remote-access software left installed, sometimes set to start automatically and to allow unattended connections.
• Often: settings changed — a new administrator account, a modified firewall, security tools disabled, a proxy or DNS entry added.
• Sometimes: passwords viewed or captured from a browser, or account recovery emails read.
• Sometimes: nothing at all beyond the payment, if you disconnected quickly.

Securing your accounts

1. 1

   Start with email

   Your email account controls password resets for everything else. Change that password first, from your clean device.

2. 2

   Then banking and anything with a card on file

   Banking, payment apps, shopping accounts. Use a different password for each.

3. 3

   Turn on multi-factor authentication

   On email and banking at minimum. This is the single change that most reduces the damage from a stolen password.

4. 4

   Check for changes someone else made

   In your email settings, look for forwarding rules, added recovery addresses or phone numbers, and unfamiliar signed-in devices. Sign out of all sessions.

5. 5

   Watch your statements

   Review bank and card statements for the next few months. Small test charges often precede larger ones.

Keep the details

• The phone number you called or that called you, and the date and time.
• The name of any software they had you install.
• Receipts, gift card numbers and photos of cards, transaction references and amounts.
• Screenshots of the original warning message, if you have any.

Your bank will ask for this, and it is also useful when reporting the incident to the FTC at reportfraud.ftc.gov. Keep it even if you think recovery is unlikely.

Having the computer checked

The point of an inspection is not just running a scan. What matters is finding what was left behind and what was changed:

• Remote-access tools installed during the session, including ones configured for unattended access.
• Scheduled tasks, services and startup entries added to bring those tools back.
• New user accounts, especially administrator accounts.
• Firewall, DNS, proxy and browser settings that were altered.
• Any actual malware, credential-stealing tools or browser extensions.
• Security software that was disabled and never re-enabled.

Uninstalling the obvious program from the Apps list is a reasonable start but frequently misses the persistence — the parts that quietly restore access later.

When to stop doing this yourself

Stop if you are not certain the remote software is gone, if the machine behaves oddly afterwards, if money was taken, or if banking or work systems were open during the session. Those situations need someone to go through the machine properly rather than assume a scan settled it.

Bring the computer to our counter in Bellevue and tell us exactly what you remember about the session — what was installed, what was on screen, how long they were connected. That history shapes what we look for.