Microsoft Scam: How to Spot Fake Tech Support and What to Do

A Microsoft scam is when someone pretends to be Microsoft support, usually through a fake virus warning with a phone number or an unexpected call, to get remote access to your computer, your passwords or a payment for “repairs” you don’t need. Microsoft says its real error and warning messages never include a phone number to call, and that it doesn’t make unsolicited calls to offer tech support. If you already let someone in, disconnect the computer from the internet, call your bank using the number on your card, and change your passwords from a different device.

If you fell for one, you’re in good company. These scams are run by organized groups using polished scripts, and they are designed to catch people at a moment of panic. What matters now is limiting the damage in the right order.

How a Microsoft tech support scam works

Almost every version follows the same pattern. The scammer creates a sense of emergency, convinces you that “Microsoft” has spotted a problem, and then asks for something: access to your computer, your login details or money.

Once they’re connected to your screen, they typically show you normal system logs or error lists and describe them as proof of infection. Then comes the ask: a “security package”, a “support subscription”, or a payment to fix a problem that was never there. Some go further and claim you were accidentally refunded too much, then pressure you to send the “difference” back.

The scammer isn’t really interested in your computer. The goal is money, and remote access gives them ways to get it, including sight of your banking sessions and the ability to install software that lets them return later.

Common versions of the Microsoft scam

The fake virus pop-up

A browser window suddenly goes full screen, flashes a warning, sometimes plays a loud voice message, and says your computer is infected or your Windows license has been blocked. It uses Microsoft logos and a toll-free number. The page may seem impossible to close. It’s a web page, not a real system alert, and it can’t harm your files on its own.

The cold call from “Microsoft support”

Someone phones claiming to be from Microsoft, Windows support or a “Microsoft certified technician”. They say your computer has been sending error reports or has been hacked, and they need to connect to it to fix it.

The fake email or text

An email says your Microsoft account will be closed, a suspicious sign-in was detected, or an order for software or a subscription has gone through. It asks you to click a link or call a number to cancel. Our guide on how to spot a phishing email covers the tells in more detail.

The fake renewal or refund

A message says your Microsoft or antivirus subscription auto-renewed and you’ll be charged unless you call. On the call, the “agent” offers a refund, asks for remote access to process it, and then claims to have refunded too much. Similar scripts are used by people posing as other tech brands, which we cover in our guide to the Geek Squad scam.

Warning signs it isn’t really Microsoft

• A pop-up or email with a phone number to call. Microsoft says genuine error and warning messages don’t include support phone numbers.
• A call you didn’t ask for. Microsoft says it doesn’t make unsolicited calls to offer technical support or ask for personal or financial information.
• Pressure to act right now, often with warnings that your data, bank or identity is at risk if you hang up.
• A request to install remote-access software or visit a site that lets them see and control your screen.
• Payment by gift card, crypto, wire transfer or payment app. These are the scammer’s favorite methods because they are hard to reverse. See our guide to gift card scams.
• Being asked to stay on the line while you go to the bank, or to keep the call secret from family.
• A “refund” that is too big, followed by a request to send back the difference.

What to do right now if you’ve been targeted

If you only saw a pop-up and didn’t call, the fix is simple. If you spoke to someone, gave access or paid, work through the steps in order.

1. Close the fake pop-up. Close the browser tab or window. If it won’t close, use Task Manager (Ctrl+Shift+Esc) to end the browser, then reopen it and don’t restore the previous session. Don’t call the number.
2. Hang up and stop contact. If you’re on a call, end it. If they call back, don’t answer. There is no need to explain or argue.
3. Disconnect the computer from the internet if they had remote access. Turn off Wi-Fi or unplug the network cable so the session can’t continue.
4. Call your bank or card issuer using the number on the back of your card or in the official app. Tell them it was a tech support scam and ask them to stop or dispute any payments and watch for new ones. If you logged into online banking while they were connected, say so.
5. Change your passwords from a different, clean device. Start with email and banking, then your Microsoft account and anything else you used during the call. Turn on two-step verification. If you think your Microsoft account itself was taken over, follow our guide to Microsoft account recovery.
6. Remove what they installed. Uninstall any remote-access program you don’t recognize, then run a full scan with Microsoft Defender or your security software. If you’re not comfortable doing this, take the computer to a local repair shop you find yourself, and tell them what happened.
7. Save the evidence. Note the phone number, the website address, what they said, the time of the call, and any payment details or receipts.
8. Protect your identity if you shared your Social Security number or ID documents. Place a fraud alert or credit freeze with the credit bureaus.

Where to report a Microsoft scam

• Microsoft: Microsoft has an official page for reporting tech support scams. Find it by going to microsoft.com yourself and searching for “report a scam”.
• The FTC: file a report at ReportFraud.ftc.gov.
• The FBI: report to the Internet Crime Complaint Center at ic3.gov, including the phone numbers, websites and payment details.
• IdentityTheft.gov if they took personal details that could be used to open accounts in your name.
• Your carrier: forward scam texts to 7726 (SPAM).
• Your browser: most browsers let you report an unsafe site, which helps get the fake pop-up page blocked for others.

Our guide on how to report a scammer explains what each route does and how to report outside the US.

Can you get your money back?

It depends on how you paid, and speed matters.

How you paid	What you can try
Credit or debit card	Ask your card issuer for a dispute or chargeback. Card payments usually offer the best chance, especially when you report quickly.
Bank transfer or wire	Report it as fraud to your bank at once. A transfer can sometimes be recalled if the money hasn’t moved on, but wires are often impossible to reverse once collected.
Gift cards	Contact the company that issued the card, say it was used in a scam and ask whether the balance can be frozen. Keep the cards and receipts.
Payment apps or crypto	Report it in the app or to the exchange straight away. These payments are often hard or impossible to reverse, but a report creates a record and sometimes funds can be frozen.

Soon after, you may be contacted by someone offering to recover your money for a fee, sometimes claiming to be from Microsoft, a law firm or a government agency. That’s usually a second scam. Our guide to recovery scams explains how they work.

A worked example

This is an illustrative scenario, not a real case. A retired teacher is reading a news site when her screen fills with a red warning and a voice saying her computer is infected. She calls the number. The “Microsoft technician” asks her to install a program so he can help, then shows her lists of “errors” and quotes a fee for a three-year protection plan.

Something feels off when he asks her to log into her bank “to process the payment securely”. She hangs up and:

1. Turns off her Wi-Fi so the connection ends.
2. Calls her bank using the number on her debit card, explains what happened and asks them to monitor her account.
3. Changes her email and banking passwords on her phone, with two-step verification turned on.
4. Uninstalls the remote-access program and runs a full Microsoft Defender scan.
5. Reports the number and website to Microsoft, the FTC and ic3.gov.

When a caller rings the next week offering to “refund her Microsoft fees”, she recognizes the pattern and doesn’t engage.

Common mistakes

• Calling the number to “check” if it’s real. Any number on a pop-up or in a surprise email belongs to the scammer.
• Leaving remote-access software installed. Even after you hang up, some programs let the scammer reconnect later.
• Changing passwords on the same computer before it’s been cleaned. Use a phone or another device you trust.
• Waiting because you feel embarrassed. Your bank handles these cases every day, and every hour counts.
• Trusting a search ad for “Microsoft support”. Scammers buy ads too. Type microsoft.com yourself.

How to protect yourself next time

• Treat every phone number on a screen alert as fake. Close the window instead.
• Never give remote access to anyone who contacted you first, whatever company they name.
• Keep Windows and your browser updated, and use the built-in security tools.
• Use a password manager and two-step verification so one leaked password doesn’t open everything.
• Talk to older relatives about this scam in a calm, practical way. A simple rule helps: “Microsoft won’t call you, and a pop-up with a phone number is never real.”

If scammers are using your name, photos or business identity to run a scam like this, see our guide on what to do if someone is impersonating you online. If complaints or fake profiles tied to you now show up in search results, our personal reputation management team can help you understand what can realistically be done.

Frequently asked questions

Does Microsoft ever call you about a virus?

Microsoft says it doesn’t make unsolicited calls to offer technical support or to ask for personal or financial information. If someone calls claiming to be Microsoft about a virus or error, hang up.

Is the Microsoft virus warning pop-up real?

A pop-up in your browser that tells you to call a number is not a real Microsoft alert. Microsoft says its error and warning messages never include phone numbers. Close the browser, using Task Manager if needed, and don’t call.

I gave a scammer remote access. What should I do?

Disconnect the computer from the internet, uninstall the remote-access program, run a full security scan and change your passwords from another device. Call your bank if you logged into any financial accounts during the session.

Can a fake pop-up damage my computer?

The pop-up itself is usually just a web page designed to scare you. The damage comes from calling the number and letting the scammer in. If you closed it without calling, you typically don’t need to do anything else beyond staying alert.

How do I report a Microsoft tech support scam?

Report it to Microsoft through its official report-a-scam page on microsoft.com, to the FTC at ReportFraud.ftc.gov, and to the FBI at ic3.gov. Include the phone number, website and any payment details.