The fake phone call
from «tech support»

No. Neither Microsoft, Apple nor Google phone you to warn you about a virus, and your bank won't ring asking you to install a remote control program either. None of these companies needs to get into your computer from outside to fix anything: if there really is a security problem, you'll be told inside your account or through the channels you already use, never by a call asking you to open something while you talk. The only purpose of that call is to get you sitting at your PC in a hurry, because once you're there the script is ready: a remote access program, a code you have to read out loud, or simply your card details. If you get one of these calls, you don't need to judge whether it sounds believable or not: the rule is always the same. Hang up, and if you want to check, ring the number you already had saved before that call.

That proves nothing, and it's exactly what makes the call believable. Caller ID can be faked with tools anyone can get hold of, so seeing the name or number of your phone provider, your bank or even one of your contacts on the screen doesn't mean that person or company is on the other end. It's the same technique used to make phishing texts with a fake sender look credible. There's no point asking «are you really from Movistar?» or asking them to confirm it some other way over the phone, because someone calling with bad intentions is ready for that question. The only thing that works is not continuing the conversation on that channel: hang up and dial the number you already had before the call, the one on a real bill or on the back of your card. If it was a genuine matter, they'll deal with you just the same when you call; if it was fraud, that second contact simply doesn't exist.

They are legitimate remote control programs that real technicians use every day to provide support at a distance. The problem isn't the tool, it's who asks you to install it and when: if someone you weren't expecting has rung you and, in that same call, walks you through downloading it, what they're asking for is full access to your screen and, if you accept one more permission, control of the keyboard and mouse as if they were sitting at your computer. From there they can see saved passwords, open banking sessions and documents, and guide you into authorising payments or transfers yourself without it looking like anything is being stolen. The rule is simple: only install this kind of program when you have called a support service you trust and that person asks you to, as part of something you started. If the call came out of the blue and five minutes later they're guiding you to install it, it isn't support, it's the attack.

It's the same play in a different costume: instead of fear of a virus, they use fear of losing money or of a penalty. No large company handles a fine or a refund over the phone by asking you to install a program or read a verification code out loud; those matters, if they really exist, are dealt with inside your account, in writing or at a branch, never by someone on the phone rushing you to act «before the deadline closes». Look at the pattern, not the details of the particular excuse: there's always a sum of money involved, there's always an invented urgency, and the next step is always to install something or read out a number. If they offer you a refund, hang up and check your real account yourself, without using any link or number they gave you during the call. A genuine refund shows up on its own, without you having to give anyone access to anything to receive it.

First cut the connection: close the remote control program, or simply switch the computer off if you don't know how to close it. Then, from another device that hasn't been exposed (your mobile, for instance), change your banking and email passwords, because if they saw your screen they may have seen more than you think. Tell your bank as soon as possible, even if you haven't noticed any odd transactions yet: they can monitor the account or block operations while it's being sorted out. If you find money has already been moved, it's worth reporting it to the police. One important point: if, at the moment you realise, there's a transfer in progress or the bank is guiding you over the phone, don't yank the router's plug thinking that cuts everything off; it may complicate things more than it helps. Call the bank first and follow their instructions. The computer gets checked afterwards, calmly, and the remote access tool is uninstalled before you go back to using it normally.

No, the call on its own doesn't infect anything: they need you to actively do something, such as installing a program or reading out a code you receive by text. That's why the whole script is designed to get you to the computer and keep you there in a hurry, because without that step they get nothing. It's different from other scams where opening a link or an attachment is enough: here they need your active cooperation, and knowing that works in your favour. You can listen to the whole pitch, let them explain the «problem» they've detected and ask all the questions you like without any real risk, as long as you don't install anything or read out any code. The moment of danger isn't the call, it's the click on the download link or your voice reading numbers off a screen. Hang up before they ask for either, and nothing will have happened.

That on-screen warning is the scam, not a real message from Windows or your antivirus. It usually appears while you're browsing, fills the whole screen, sometimes plays an alarm sound and shows a phone number for you to call «urgently». It's the same scam as the incoming call, just started the other way round: instead of them ringing you, they get you to ring them, which also makes you trust it more because «you were the one who looked for help». Don't call that number under any circumstances. Try closing the browser normally; if the window won't let you or reopens by itself, close the browser from Task Manager or switch the computer off and on again. When you reopen the browser, don't restore the previous session if it offers to, so that tab doesn't load again. You don't need to call anyone or install anything to get rid of that warning: closing the browser makes it go away.

You call them, always, on a number you've obtained yourself: the one on a paper bill or in your customer area, the one on the official website whose address you type into the browser yourself instead of clicking a link, or the one printed on the back of your bank card. Never the number from an incoming call, nor the one in a browser pop-up warning, nor one that arrives by text or email asking you to call «to verify your account». If you look the number up online, bear in mind there are also fake ads and pages posing as official support among the top search results, so it's better to always start from a document you already had, not a fresh search. With that habit (you always start the contact) the whole script of this scam no longer has any way in.