Phone scams › Tech support scam

Tech Support Scams: Fake Microsoft Calls, Pop-Ups and Refund Tricks

Tech support scams reach you through alarming browser pop-ups with support numbers or cold calls claiming to be Microsoft, Apple, or your ISP detecting viruses. The 'fix' requires remote access to your computer, which becomes the real infection: stolen banking sessions, planted malware, and fake refund tricks. Real tech companies never cold-call about infections and their error screens never include phone numbers.

Also known as: Microsoft support scam, virus warning pop-up, refund scam.

By the LookUpSomeone editorial team · Last reviewed 2026-08-06

Got a suspicious call or text?

Check the Number Before You Call Back

See the owner’s name, carrier, location, and any scam reports in seconds. (May reveal social media profiles, online footprints, pics and more.)

100% confidential lookup - the person you search will not know.

How does the Tech support scam work?

A full-screen browser pop-up with alarm sounds claims infection and displays a toll-free 'support' number, or a caller claims your machine is sending error signals.
The 'technician' has you install remote-access software and shows you harmless system logs as 'proof' of infection.
Payment is taken for cleanup or a support plan; card details are now harvested too.
The refund variant calls previous victims offering their money back, 'accidentally' refunds too much via a doctored banking screen, and pressures you to return the difference in gift cards.

What does the Tech support scam sound like?

A typical opening, paraphrased from the scripts reported to fraud agencies. Wording varies, but if your call or text follows this shape, treat it as this scam:

Unknown caller Typical example

WINDOWS DEFENDER SECURITY ALERT. Your computer has been infected with Trojan Spyware. Your banking passwords and photos are being transmitted. Do not shut down your computer or your data will be lost. Call Microsoft Support immediately at 1-8XX-XXX-XXXX. [A blaring alarm plays on loop while the message fills the screen.]

Common variations of this scam

Browser lock pop-up. A malicious webpage goes full-screen with alarms and a fake infection report, displaying the 'support' number that starts the scam.
Cold call from 'Microsoft' or your ISP. A caller claims your machine is sending error signals or infecting the network and walks you into granting remote access.
Refund overpayment. 'Support' from a company you once paid offers a refund, fakes an overpayment on a doctored banking screen, and demands the difference in gift cards.
Subscription renewal invoice. An email invoice for Geek Squad, Norton, or McAfee renewal at $300-$500 provides a cancellation number that connects to the scam center.

What are the warning signs?

Any pop-up with a phone number; real Windows/macOS errors never include one
Cold calls about viruses or 'error reports' from your computer
Requests to install AnyDesk, TeamViewer, or similar for a problem you didn't report
Payment for cleanup in gift cards or crypto
'Refunds' requiring you to send money back

Who do these scammers target?

Older and less tech-confident users are the deliberate center of this scam; call centers keep lists of past victims for refund-scam callbacks. The renewal-invoice variant targets anyone who has ever used a security product, and browser lock screens catch people of every age off guard with pure panic.

Scammers also spoof local numbers to raise answer rates, so a familiar-looking area code means nothing on its own. If a specific code keeps calling you, check its scam activity in the area code directory.

What should you do?

Close the pop-up (Ctrl+Alt+Del / force-quit the browser if needed); don't call the number. The pop-up itself does nothing without your call.
Never grant remote access to anyone who contacted you first.
If access was granted: disconnect from the internet, uninstall the remote tool, run a malware scan, change passwords from another device, and call your bank if banking happened on that machine.
Run the number from the pop-up or call through a reverse phone lookup; these numbers accumulate reports fast.
US: report to the FTC. Canada: Canadian Anti-Fraud Centre. Also report the number to the FCC if it was a robocall.

Official reporting: FTC: report fraud (US) · FCC: unwanted call complaints (US) · Canadian Anti-Fraud Centre (CA)

How do you protect yourself going forward?

Remember one fact that defuses every variant: real Windows and macOS error messages never include a phone number.
Escape screen-lockers with force-quit (Ctrl+Alt+Del or Cmd+Option+Esc) instead of calling; the page is just a webpage.
Grant remote access only to technicians you contacted through an official channel yourself.
Keep your OS and browser updated and use their built-in pop-up and scam-site protections.

Frequently asked questions

Does Microsoft ever call users about viruses?

No. Microsoft states it never makes unsolicited calls about device problems, and its error messages never include phone numbers. The same applies to Apple and legitimate ISPs' security teams.

A pop-up locked my whole screen with alarms. Was I hacked?

Almost certainly not; it's a malicious webpage abusing full-screen mode. Force-quitting the browser clears it. Infection happens only if you call and grant access or install what they tell you.

How does the fake refund trick work?

With remote access, the scammer edits the HTML of your online-banking page so it displays an oversized 'accidental refund'. No real money arrived, but victims send back the 'difference' in gift cards, which is a pure loss.

I paid a fake support company by card months ago. Worth reporting?

Yes. Dispute the charge with your card issuer (many victims recover card payments), and report the operation to the FTC or CAFC; those reports drive the enforcement sweeps that shut these call centers down.

Getting calls from a specific area code? Check its scam activity in the area code directory, or go straight to a reverse phone lookup.