What's going on
Someone rings your phone and says they're from Microsoft, Windows Technical Support, or sometimes your broadband provider. They tell you your computer has a virus, it's been hacked, or it's sending error reports to their servers. They sound calm, professional, and concerned. And they want to help you fix it right now.
The whole thing is fake. There's no virus. There are no error reports. The person on the phone doesn't work for Microsoft and has no idea what's on your computer. What they want is remote access to your machine, your card details, or both. This scam has been running for well over a decade and it's still catching people out every single day.
How the scam works
It follows the same pattern almost every time. The caller builds trust, creates fear, gets access to your computer, and then takes your money. Here's each stage.
1. The cold call
Your phone rings. The caller says they're from Microsoft, Windows Technical Support, or BT's technical team. They might use a UK number on the caller ID. They tell you your computer is sending out errors or has been compromised. They sound professional, patient, and genuinely worried about your machine.
Why people believe it
Most people use Windows. Most people have had a genuine computer problem at some point. The caller sounds calm and helpful, not aggressive. It feels like a courtesy call, not a scam.
2. The fake evidence
They walk you through opening Event Viewer or running commands that show normal system logs. They present routine warning messages as proof that your computer is riddled with viruses or that hackers are inside your system right now. On a computer you don't fully understand, it looks terrifying.
What they show you
- • Event Viewer warnings and errors (normal on every PC)
- • CLSID strings that look like hacker codes (they're not)
- • Netstat connections (standard network activity)
- • All of this appears on every single Windows computer
3. Remote access
They ask you to download TeamViewer, AnyDesk, or similar software so they can "fix" your machine. Once connected, they can see everything on your screen, access your files, open your browser, and watch you type passwords. Some install hidden software that lets them reconnect later without you knowing.
It goes beyond your computer
With remote access, they can watch you log in to your online banking, see saved passwords in your browser, access your email, and install keyloggers that record every keystroke you make long after the call ends.
4. The payment
They charge you for the "fix", usually somewhere between £100 and £500. They'll ask for card details over the phone or get you to log in to your bank while they're still connected. Some set up recurring payments you won't notice for months. Others install ransomware and demand more money to unlock your files. The payment is just one part of it. The real damage is the access they now have to everything on your machine.
What these calls sound like
There are several scripts doing the rounds. The wording changes, but the pattern is always the same: create a problem, then offer to fix it.
"The virus warning"
The classic opening. They say your computer is infected and sending data to hackers. They ask if you've noticed it running slowly. Most people have, because most computers do sometimes.
"Hello, I'm calling from Microsoft Windows Technical Support. We've detected that your computer has been infected with a dangerous virus and is sending your personal data to hackers overseas. Have you noticed your computer running slowly?"
"The broadband problem"
The BT variant. They claim your broadband connection is sending errors to their servers and they need to check your computer to sort it out. Same scam, different costume.
"Good afternoon, I'm calling from your internet service provider. We've been monitoring your broadband connection and it's sending error signals to our servers. We need to check your computer to fix this. Can you turn on your PC for me?"
"The licence expiry"
The Windows licence scare. They tell you your licence has expired and your computer will be locked unless you renew immediately. Creates urgency out of thin air.
"This is an urgent call regarding your Microsoft Windows licence. Your licence has expired and your computer will be locked within 24 hours unless we renew it today. I can help you with this now if you go to your computer."
"The refund"
A twist on the usual approach. They say they owe YOU money from a previous service call and need you to log in to your bank so they can process the refund. The refund doesn't exist.
"I'm calling from Microsoft support regarding a refund of £299.99 that is owed to you for a service contract that was overcharged. I just need you to log in to your bank so I can process the refund directly."
Who falls for this
Anyone who isn't particularly familiar with how computers work under the bonnet. That's not an insult. Most people don't know what Event Viewer is. Most people couldn't tell a real system warning from a fake one. And that's exactly what these scammers rely on.
Older people are targeted more heavily because they're statistically less likely to be confident with technology and more likely to trust someone who sounds official. But younger victims get caught too. If you've ever let a computer problem drag on because you didn't know how to fix it, you know that feeling of wanting someone to just sort it out for you. These callers exploit that.
What makes it convincing
- • The caller sounds professional and unhurried
- • Most people genuinely use Windows
- • Event Viewer logs look alarming if you've never seen them
- • The caller uses real Microsoft terminology
- • They offer to fix a problem you might actually have
What should make you stop
- • Microsoft doesn't ring people out of the blue
- • No company monitors your computer without your consent
- • Real tech support doesn't cold call and ask for remote access
- • Legitimate companies don't take payment over the phone like this
- • You didn't contact them first
If you get one of these calls
Hang up
Don't engage with the caller. Don't press any buttons. Don't try to waste their time or argue with them. Just put the phone down.
Don't download anything
If someone you didn't contact asks you to install software on your computer, refuse. It doesn't matter how helpful they sound or what reason they give. Nobody legitimate operates this way.
Report to Action Fraud
Call 0300 123 2040 or report online. Even if you didn't lose money, your report helps Action Fraud track these operations and shut them down.
Report online at actionfraud.police.uk or call 0300 123 2040.
Report to Microsoft
Microsoft tracks these scams and uses reports to take down fraudulent operations. You can report directly through their website.
Block the number
Block the number on your phone so they can't ring you again from the same one. It won't stop them calling from a different number, but it's one less route in.
Already let them connect?
Don't panic, but do act fast. The sooner you deal with this, the less damage they can do.
-
1
Disconnect from the internet now
Pull the ethernet cable out or turn off WiFi. This cuts their connection to your computer immediately. If they're still connected via remote access software, this stops them in their tracks.
-
2
Uninstall the remote access software
Remove TeamViewer, AnyDesk, or whatever they had you install. Check your installed programs for anything else you don't recognise. If you're not sure what's safe to remove, ask someone you trust or take the machine to a local computer repair shop.
-
3
Run a full virus scan
Use Windows Defender (it's already on your computer) or download Malwarebytes. Both are free. Run a full scan, not a quick one. This will pick up anything they may have installed while they had access.
-
4
Change your passwords
Every account you logged into while they were connected needs a new password. Start with your email and online banking. Do this from a different device if you can, like your phone or a tablet, just in case they installed something that records what you type.
-
5
Call your bank
If you gave card details or logged in to your banking while they were watching, call your bank immediately. Use the number on the back of your card or dial 159. Tell them what happened. They can freeze your account and watch for suspicious transactions.
-
6
Report to Action Fraud
Call 0300 123 2040 or go to actionfraud.police.uk. You'll get a crime reference number. Keep it safe. You may need it if you make a claim to get your money back.
The short version
Red flags
- • Unsolicited call claiming to be Microsoft or your ISP
- • Says your computer is infected or sending errors
- • Wants you to open Event Viewer or run commands
- • Asks you to install remote access software
- • Demands payment for a repair or licence renewal
What to do
- • Hang up immediately
- • Never install software a cold caller asks for
- • Report to Action Fraud (0300 123 2040)
- • Report to Microsoft at microsoft.com/concern/scam
- • If they connected, disconnect and change your passwords