The scam in one sentence
In a tech support scam, someone convinces you that something is wrong with your computer, phone or account, then offers to fix it for a fee or by gaining access to your device. The problem they describe usually does not exist. The fix they sell is the real harm.
The scam persists because it targets a real worry. Most people are not sure how to tell a genuine warning from a fake one, and a confident, helpful-sounding voice on the line is reassuring. Understanding the standard script makes the pattern easier to recognise.
How the contact starts
Tech support scams reach people through a few routes.
- A browser pop-up or full-screen warning. A page claims your device is infected, blocked or reported, and may show alarming sounds, flashing images or a countdown. It often makes it difficult to close the window. It also shows a phone number to call.
- An unexpected phone call. The caller says they are from a well-known technology company, your internet provider or a “security department” and claims they have detected a problem on your device.
- A fake alert from a search result or advert. Someone searching for a company’s helpline may land on a scammer’s number placed prominently in an advert or a lookalike page.
- An email or text about a charge. A message claims you have been billed for a subscription, with a number to call to dispute it. The call then moves into the same script.
In every version, the aim is to get you on the phone with someone who controls the conversation.
The usual script
Once you are talking, the steps tend to run in a recognisable order.
- Establish authority. The caller uses a company name, technical language and a calm manner. They may give an “employee ID” or reference number, which proves nothing.
- Demonstrate the problem. They guide you to a screen that looks alarming but is normal. Common examples are lists of system messages or error logs that every computer produces. They present these as proof of infection.
- Raise the stakes. They say your accounts, money or identity are at risk and the situation is urgent. This is classic social engineering: fear and time pressure discourage you from checking.
- Request access. They ask you to install a remote-control program, which lets them see and operate your screen. Once running, they can open files, browse your accounts and install other software.
- Do pretend repairs. On screen, they appear to remove viruses or fix settings. Sometimes they actually make the situation worse by changing settings or leaving software behind.
- Collect payment. They ask for payment for the “service”, often a one-off fee or a multi-year plan. Preferred methods are those that are difficult to reverse, such as gift cards, bank transfers, payment apps or crypto wallets.
- Escalate or repeat. Some scammers return later claiming a refund is due, then trick the victim into “accidentally” sending money back. Others use access gained to reach online banking.
The refund twist
A variation worth knowing about is the fake refund. After you pay, the caller says there has been an error and you have been refunded too much. They guide you through your bank website while controlling your screen and make it appear that extra money has arrived, then ask you to send the difference back. In reality the figures on screen have been altered or money has simply been moved between your own accounts. What you send back is real. Because the display can be manipulated, never trust what a screen shows while someone else controls it.
Why real companies do not work this way
Several features of the script are very unlike how genuine support works.
- Companies do not phone you out of the blue to report a virus. They generally cannot see the state of your individual device, and unsolicited warning calls are not how they provide support.
- Browser warnings do not include a helpline. Genuine security alerts from your operating system or antivirus software do not ask you to call a phone number to clear them.
- Legitimate support does not demand unusual payment. Payment by gift card or by transfer to a personal account is a strong warning sign.
- You start the contact, not them. If you do need help, you reach out through the official website or app, typed in yourself.
- Real staff do not insist on secrecy or speed. Pressure not to hang up, not to tell anyone, or not to check is a mark of a scam.
None of this means every unexpected call is fraud, but it is a good reason to end the call and verify through an official channel.
What to do in the moment
If a pop-up appears, do not call the number on it. Try closing the browser or the tab; if the page will not close, the usual approach is to force-quit the browser or restart the device, and many browsers offer to avoid restoring the previous tabs. Do not click buttons within the alert.
If you are on a call, hang up. You do not owe the caller politeness, and ending the call cannot hurt you.
If you already gave access or paid
Disconnect the device from the internet, then remove the remote-access program. Run a scan with trusted security software and check that software updates are applied. From a different, clean device, change important passwords starting with email, and follow the steps in a good account takeover recovery routine. Contact your bank or card issuer if you paid or shared financial details; they may be able to block cards and review transactions, though recovery is not assured. Keep notes of numbers, times and amounts, and consider reporting the incident to your national consumer protection or fraud reporting service.
Helping someone else
These scams often affect people who are less confident with technology, though anyone can be caught. A calm conversation beforehand works better than a lecture afterwards. Agree a simple rule: if anyone calls or a screen demands action about a problem, stop and ask someone else before doing anything. Making it easy to ask without embarrassment is one of the most effective protections available.