Technical support scam

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search
A common fake pop-up tricking victims into thinking their computer has been infected with malicious viruses
A tech support scam on an iPhone.

A technical support scam refers to any of class a telephone fraud activities in which a scammer claims to offer a legitimate technical support service, often via cold calls to unsuspecting users. Such calls are mostly targeted at Microsoft Windows users, with the caller often claiming to represent a Microsoft technical support department.

In English-speaking countries such as the United States, Canada, United Kingdom, Ireland, Australia and New Zealand, such cold call scams have occurred as early as 2008[1] and primarily originate from call centers in India.[2]

The scammer will typically attempt to get the victim to allow remote access to his or her computer. After remote access is gained, the scammer relies on confidence tricks, typically involving utilities built into Windows and other software, in order to gain the victim's trust to pay for the supposed "support" services. The scammer will often then steal the victim's credit card account information or persuade the victim to log into his or her online banking account to receive a promised refund, only to steal more money, claiming that a secure server is connected and that the scammer cannot see the details. Many schemes involve convincing the victim to purchase expensive gift cards and then to divulge the card information to the scammer.[3]


Fake Blue Screen of Death pop-up tricking the victim that their computer has a "system crash" and can no longer operate safely unless they call the toll-free number to "resolve" the issues.

Technical support scams typically rely on social engineering. Scammers use a variety of confidence tricks to persuade the victim to install remote desktop software (often by informing the victim that the scammer is connecting the computer to a "secure server"), with which the scammer can then take control of the victim's computer. With this access, the scammer may then launch various Windows components and utilities (such as the Event Viewer), install third-party utilities (such as rogue security software) and perform other tasks in an effort to convince the victim that the computer has critical problems that must be remediated, such as infection with a virus. The scammer will urge the victim to pay, with a credit card or gift card, in order that the issues may be "fixed".[1][4][5]


Screenshot of a Recent Changes page from a MediaWiki site affected by customer support scammers promoting their "help lines" through unethical means such as spamming.

Technical support scams can begin in a variety of ways.[4][6] A scam most commonly begins with a cold call, usually claiming to be associated with a legitimate-sounding third party, with a name like "Microsoft" or "Windows Technical Support".[2] Scammers have also lured victims by purchasing keyword advertising on major search engines (with ads triggered by phrases such as "Microsoft live chat", "Facebook support", or "Outlook login help"), though both Bing and Google have taken steps to restrict such schemes. Other techniques include email spamming and cybersquatting to lead potential victims to web pages containing scammers' phone numbers.[7][8] Some scams have been initiated via pop-up ads on infected websites instructing the potential victim to call a number. These pop-ups often closely resemble legitimate error messages such as the Blue Screen of Death.[9][10]

Remote access[edit]

While normally following a script, the scammer usually instructs the victim to download and install a remote access program, such as TeamViewer, AnyDesk, LogMeIn, GoToAssist,[11] ConnectWise Control (known also as ScreenConnect), etc. With the software installed, the scammer convinces the victim to provide them with the remote access software's credentials or other details required to initiate a remote-control session, giving the scammer complete control of the victim's desktop.[1][12]

Confidence tricks[edit]

After gaining access, the scammer attempts to convince the victim that the computer is suffering from problems that must be repaired, most often as the putative result of malicious hacking activity. Scammers use several methods to misrepresent the content and significance of common Windows tools and system directories as evidence of malicious activity, such as viruses and other malware. Normally the elderly and other vulnerable parties, such as those with limited technical knowledge, are targeted for technical support scams.

  • The scammer may direct users to Windows' Event Viewer, which displays a log of various events for use by system administrators and expert users to troubleshoot problems. Although many of the log entries are relatively harmless notifications, the scammer may fraudulently claim that log entries labeled as warnings and errors are evidence of malware activity or that the computer is becoming corrupted, and that the errors must be "fixed".[4][6][13]
  • The scammer may present system folders that contain unusually named files, such as Windows' Prefetch and Temp folders, and claim that the files are evidence of malware on the system. The scammer may open some of these files (especially those in the Prefetch folder) in Notepad, where the file contents are rendered as mojibake. The scammer claims that malware has corrupted these files, causing the unintelligible output. In reality, the files in Prefetch are typically harmless, intact binary files used to speed up certain operations.[13]
  • The scammer may misuse Command Prompt tools to generate suspicious-looking output, for instance, the tree or dir /s command, which displays an extensive listing of files and directories. The scammer may claim that the utility is a malware scanner, and while the tool is running, the scammer will enter text purporting to be an error message (such as "security breach ... trojans found") that will appear when the job finishes, or into a blank Notepad document.[14]
  • The scammer may misrepresent values and keys stored in the Windows Registry as being malicious, such as innocuous keys whose values are listed as not being set.[4]
  • The "Send To" Windows function is associated with a globally unique identifier. The output of the command assoc, which lists all file associations on the system, displays this association with the line ZFSendToTarget=CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}; this GUID is the same on all versions of Windows. The scammer may claim that this is a unique ID used to identify the user's computer, or claim that the CLSID listed is actually a "Computer Licence Security ID" that must be renewed.[15][16]
  • The scammer may claim that the system's problems are the result of expired hardware or software warranties, for example, Windows product keys, and coax the victim into paying for a "renewal".[6][13]
  • The scammer may run the obscure syskey utility and configure a startup password known only to the scammer, thereby locking the victim out of his or her own system after the computer is rebooted.[17][18] As syskey is only present in Windows versions previous to Windows 10, the scammer may force the user to become locked out by installing a keylogger and changing the user's account password and/or setting a PIN login requirement if the victim's computer runs on Windows 10.[19]
  • The scammer may delete Windows critical files and folders such as system32, making the computer unusable until the operating system has been reinstalled.
  • The scammer may use their remote access software to surreptitiously download or delete confidential files or documents from the victim’s system while employing distraction techniques or while the victim is away from the computer procuring payment.
  • The scammer may block the victim from viewing his or her screen, claiming that it is the result of malware or of a scan being run, and use the time to search the user's files for sensitive information, attempt to break into the user's accounts with stolen or stored credentials or activate the webcam and see the user's face.[19]
  • The scammer may run the netstat command in a terminal/command window, which shows local and foreign IP addresses. The scammer then tells the victim that these addresses belong to hackers that have intruded the computer.
  • The scammer may claim that a normal Windows process such as rundll32.exe is a virus. Often, the scammer will search the Internet for an article about the Windows process and will scroll to a section saying that the process name can also possibly be part of malware, even though the victim's computer does not contain that malware.


These tricks are meant to target victims who may be unfamiliar with the actual uses of these tools, such as inexperienced users and senior citizens—especially when the scam is initiated by a cold call.[1][2][20] The scammer then coaxes the victim into paying for the scammer's services or software, which they claim is designed to "repair" the computer but is actually malware that infects it or software that causes other damage.[21] The scammer may gain access to the victim's credit card information, which can be used to make additional fraudulent charges. Afterward, the scammer may also claim that the victim is eligible for a refund, and request the user's bank account information—which is instead used to steal more money from the victim, rather than providing the promised refund.[4][6][2][13][22][23] Alternatively, a scammer may attempt to request payment using gift cards for online platforms such as, Google Play, and iTunes Store.[24][25]

Unlike legitimate companies, if their targets show resistance or refuse to follow the scammer or pay them, the scammer may become belligerent and insulting, threaten[26][27] or even blackmail the user into paying them. Canadian citizen Jakob Dulisse reported to CBC that, upon asking the scammer why he had been targeted, the scammer responded with a death threat; 'Anglo people who travel to the country [India] were "cut up in little pieces" and thrown in the river.'[28][29]

In an investigation conducted by Symantec employee Orla Cox, it was revealed that after Cox paid for the fee for the scammer to remove the nonexistent "malware" infections, the scammers would then merely clear the log in the Event Viewer and disable Windows' event logging feature. This merely means that errors would no longer appear in the Event Viewer, i.e. had malware actually existed on Cox's computer, it would remain intact.[30]

Unethical and fake "support" companies[edit]

The great majority of the complaints and discussion about companies that cold-call and offer "technical support"[31] report them as being not merely incompetent or ineffective, but actively dishonest, doggedly trying to convince the victim of non-existent problems by trickery and, when possible, damaging the computer to which they gain access.[4][32][33] Computer-support companies advertise on search engines like Google and Bing,[31][34] but some are heavily criticised, sometimes for practices similar to those of the cold callers. One example is the India-based company iYogi, which has been reported by InfoWorld to use scare tactics and install undesirable software.[35][36] In December 2015, the state of Washington sued iYogi's US operations for scamming consumers and making false claims in order to scare the users into buying iYogi's diagnostic software.[37] iYogi, which was required to respond formally by the end of March 2016,[38] said before its response that the lawsuit filed was without merit.[39] In September 2011, Microsoft dropped Comantra, a Gold Partner, from its Microsoft Partner Network following accusations of involvement in cold-call technical-support scams.[40]

In December 2014, Microsoft filed a lawsuit against a California-based company operating such scams for "misusing Microsoft's name and trademarks" and "creating security issues for victims by gaining access to their computers and installing malicious software, including a password grabber that could provide access to personal and financial information".[41] In an effort to protect consumers, Microsoft-owned advertising network Bing Ads (which services ad sales on Bing and Yahoo! Search engines)[42][43] amended its terms of service in May 2016 to prohibit the advertising of third-party technical support services or ads claiming to "provide a service that can only be provided by the actual owner of the products or service advertised".[7][44] Google Search followed suit in August 2018, but went further by banning any advertising related to technical support, regardless of source, citing that it had become too difficult to differentiate legitimate providers from scams.[45]

Refund Scams and Bank Login Scams[edit]

Many call centers who run the standard technical support scam also participate in running the Refund Scam. Scamming organizations will buy, sell, or trade spreadsheets containing victim details, including the phone number with which to reach the victim again, to other call centers. A Refund Scammer's goal is to tell the victim, who has previously paid a Technical Support Scammer for services, that they are entitled to cancel their services and receive a refund. The scammer then fakes a bank transfer of a large amount of money by transferring money between the victim's own bank accounts, and convinces the victim that he must send back the excess amount. As such, the Refund Scam is much more lucrative than the initial Tech Support Scam. Some of these scammers will periodically steal bank accounts from victims, and use them to launder money as well, although gift cards remain their preferred method of payment.

Confidence Tricks[edit]

As with the initial Technical Support Scam, the Scammer must have the victim install a Remote Desktop Access Client so that they can manipulate the victim's PC or Mac computer. In many cases, the scammer will check for a document left behind on the victim's desktop by a previous scamming organization, but the scammer usually asks the victim to provide most of the necessary information, including the refund amount, over the phone call.

  • The scammer may direct the victim to a Command Prompt window, run the netstat or tree command, and type their own message which they convince the computer is telling the victim:
    • the victim is entitled to a refund
    • hackers are found in the victim's network
    • the computer's Windows License key is expired or illegal, and a new license key is needed
    • the previously-installed security or firewall application license is expired or incompatible with the computer.
  • The scammer will have the victim log in to the website of their bank in order to view their account balances, and proceed to either blacken the user's screen or zoom-out the page so that the victim cannot see what is going on, at which point the scammer transfers money between the victim's own accounts
  • The scammer moves money (typically from Savings to Checking) between the accounts, using the website. After this, he may right-click the browser to edit the HTML element of the account that's lost money to change its balance to the previous balance. The amount of money is made larger than the specified "Refund Amount" by the victim so that the scammer may get money back.
  • Because the balance moved between the accounts is too much, the scammer acts scared or surprised, and will tell the victim that there was a mistake and that he will lose his job if the victim does not go to acquire the payment method of returning the money.
  • Alternatively, the scammer may tell the victim in advance that they are getting a large amount of money because the Company has a "sending limit," or that money needs to be moved into a "virtual account" which is another stolen bank account that is being used to launder money.
  • The scammer may ask the victim to uninstall mobile banking apps from mobile phones and tablets, in order to prevent them from viewing the affected bank accounts outside of the computer that they are connected to.
  • The scammer explains to the victim how they are to pay back the excessive balance, usually via gift cards, and gives the victim coaching on what to say at the appropriate store or bank. They tell the victim that they must state that they are buying cards or transferring money for personal use or for a family member and are not allowed to mention technical support or a refund.
  • The scammer will use the syskey program or the Accounts menu to lock a noncompliant victim's computer with a password, which he will not give back to the victim until money is paid.

Some victims of a Refund Scam may get suspicious before the scammer is logged in to a bank account, and will decline to accept a refund, and the scammer may get belligerent and start damaging system files, deleting personal documents, or locking the computer with a password.

Scam baiting[edit]

Tech support scammers are regularly targeted by scam baiting[46] both online and offline, with individuals seeking to raise awareness of these scams by uploading recordings on platforms like YouTube, cause inconvenience to the scammers by wasting their time, and by disabling the scammer's computer systems by deploying RATs, distributed denial of service attacks and destructive computer viruses. Scam baiters may also attempt to lure scammers into exposing their unethical practices by leaving dummy files or malware disguised as confidential information, such as credit/debit card information and passwords, on a virtual machine for the scammer to attempt to steal, only to himself or herself become infected.

In November 2017, a company called Myphonesupport initiated a petition seeking the identities of John Doe defendants in a New York case involving a telephonic denial-of-service attack against its call centers. The case has since been disposed.[47]

See also[edit]


  1. ^ a b c d Arthur, Charles (18 July 2012). "Virus phone scam being run from call centres in India". Guardian. Archived from the original on 28 March 2014. Retrieved 31 March 2014.
  2. ^ a b c d "Hello, I'm definitely not calling from India. Can I take control of your PC?". Ars Technica. Archived from the original on 21 November 2014. Retrieved 16 November 2014.
  3. ^ Weiss, Gary. "How Scammers Use Gift Cards to Steal Your Money". AARP. Retrieved 2019-08-01.
  4. ^ a b c d e f Segura, Jérôme. "Tech Support Scams - Help & Resource Page | Malwarebytes Unpacked". Malwarebytes Corporation. Archived from the original on 28 March 2014. Retrieved 28 March 2014.
  5. ^ Weiss, Gary. "How Scammers Use Gift Cards to Steal Your Money". AARP. Retrieved 2019-08-01.
  6. ^ a b c d Hunt, Troy (February 21, 2012). "Scamming the scammers – catching the virus call centre scammers red-handed". Archived from the original on 7 April 2014. Retrieved 1 April 2014.
  7. ^ a b "Microsoft to Bing users: No more shady third-party ads for tech support, password recovery". ZDNet. Archived from the original on 14 May 2016. Retrieved 13 May 2016.
  8. ^ "Despite Crackdowns, Tech Support Ads In Search Are Still Cause For Consumer Confusion" Archived 2015-03-28 at the Wayback Machine. Search Engine Land, Ginny Marvin on August 5, 2014
  9. ^ Harley, David (7 October 2015). "Tech Support Scams: Top of the Pop-Ups". WeLiveSecurity. Archived from the original on 27 July 2016. Retrieved 28 July 2016.
  10. ^ "Do not respond to scam pop-up messages in your web browser". Department of Communications and the Arts. Archived from the original on 2016-04-20. Retrieved 2016-04-19.
  11. ^ Brodkin, Jon (25 November 2013). "Fake tech support scam is trouble for legitimate remote help company". Ars Technica.
  12. ^ Technical support scammers (8 July 2017). "Fake ConnectWise Control login purporting to be British Telecom technical department (note name of site)". Archived from the original on 8 July 2017.
  13. ^ a b c d Solon, Olivia (11 April 2013). "What happens if you play along with a Microsoft 'tech support' scam?". Archived from the original on 7 November 2014. Retrieved 10 November 2014.
  14. ^ Lodhi, Nauman. "Beware of Microsoft Tech Support Scammers". Business 2 Community. Archived from the original on 19 April 2014. Retrieved 18 April 2014.
  15. ^ "Support desk scams: CLSID not unique". WeLiveSecurity. ESET. Archived from the original on 23 October 2014. Retrieved 15 November 2014.
  16. ^ "Support-Scammer Tricks". WeLiveSecurity. ESET. Archived from the original on 25 December 2014. Retrieved 15 November 2014.
  17. ^ Woodchip computers:Have you been caught by the "I am Windows Support" scam? Archived 2014-11-08 at the Wayback Machine
  18. ^ Holzman, Carey (14 November 2014). "'Microsoft Partner' Claims Fuel Support Scams". Kerbs on Security. Archived from the original on 25 September 2016. Retrieved 26 July 2016.
  19. ^ a b Jim Browning (2018-08-04), This is why you never let anyone remotely access your computer, retrieved 2018-09-09
  20. ^ "Microsoft Phone Scams". Which?. Archived from the original on 2015-02-13.
  21. ^ Graham Scott, Gini (2016). Scammed: Learn from the Biggest Consumer and Money Frauds How Not to Be a Victim. Allworth Press. p. 182. ISBN 978-1-62153-504-1.
  22. ^ "Tech Support Scams". Federal Trade Commission. Archived from the original on 31 October 2014. Retrieved 16 November 2014.
  23. ^ Winterford, Brett (May 18, 2011). "How the Microsoft/LogMeIn support scam works". Archived from the original on 7 April 2014. Retrieved 1 April 2014.
  24. ^ "No gift cards for tech support scammers". Consumer Information. FTC. 2018-06-06. Retrieved 2018-08-22.
  25. ^ ""From laughter to death threats": Meet Kitboga, the streamer exposing tech support scams". Newsweek. 2018-05-22. Retrieved 2018-08-22.
  26. ^ Melendez, Steven (2019-05-10). "The awful, fast-growing tech scams fleecing the elderly out of millions". Fast Company. Retrieved 2019-11-15.
  27. ^ "Kitboga: The Internet star giving scammers a taste of their own medicine | CTV News". Retrieved 2019-11-15.
  28. ^ "Death threat issued in bogus tech support call". BBC News. Retrieved 24 October 2019.
  29. ^ Brodkin, Jon (2015-03-04). "Tech support scammer threatened to kill man when scam call backfired". Ars Technica. Retrieved 2019-11-15.
  30. ^ Cox, Orla (22 June 2010). "Technical Support Phone Scams". Symantec. Archived from the original on 19 August 2016. Retrieved 3 August 2016.
  31. ^ a b Hunt, Troy. "Interview with the man behind Comantra, the "cold call virus scammers"". Archived from the original on 16 April 2014. Retrieved 18 April 2014.
  32. ^ Baker, Steve. "What Seniors (And Their Children) Need To Know About Tech Support Scams". Forbes. Archived from the original on 20 April 2017. Retrieved 19 April 2017.
  33. ^ "Reputation of". WOT. Archived from the original on 2014-05-02.
  34. ^ "How iYogi & Guruaid running tech support campaigns?". AdWords Community. Retrieved 2 May 2014.
  35. ^ Cringley, Robert (28 March 2012). "The downward (dog) spiral: iYogi exposed". InfoWorld. Archived from the original on 7 April 2014. Retrieved 3 April 2014.
  36. ^ Cringley, Robert (21 March 2012). "Tech support or extortion? You be the judge". InfoWorld. Archived from the original on 29 May 2015. Retrieved 9 June 2015.
  37. ^ Washington state sues firm, alleges tech support scam Archived 2015-12-21 at the Wayback Machine, Associated Press, 16 December 2015
  38. ^ Joe Panettieri (18 March 2016). "iYogi IT Services Lawsuit: State of Washington Awaits Response - ChannelE2E". ChannelE2E. Archived from the original on 29 March 2016. Retrieved 24 March 2016.
  39. ^ Lawsuits Cloud iYogi Remote Tech Support Reputation Archived 2016-03-09 at the Wayback Machine, 11 Jan 2016
  40. ^ Microsoft Drops partner accused of Cold-Call Scams Archived 2016-06-30 at the Wayback Machine, 22 February 2016
  41. ^ Whitney, Lance (19 December 2014). "Microsoft combats tech support scammers with lawsuit". CNET. Archived from the original on 21 December 2014. Retrieved 21 December 2014.
  42. ^ "Microsoft loses exclusivity in shaken up Yahoo search deal". Ars Technica. Archived from the original on 23 June 2015. Retrieved 30 June 2015.
  43. ^ "Ad Tech And Mobile In Focus In Microsoft And Yahoo's Renewed Search Deal". TechCrunch. Archived from the original on 26 June 2015. Retrieved 30 June 2015.
  44. ^ "Bing bans tech support ads—because they're mostly scams". Ars Technica. Archived from the original on 13 May 2016. Retrieved 13 May 2016.
  45. ^ "Google to nix all tech support provider ads". iTnews. Retrieved 2018-09-03.
  46. ^ "A guide to trolling a tech support scammer". WIRED UK. Retrieved 3 October 2018.
  47. ^ "Consumer Software International, Inc. - v. - ICEHOOK SYSTEMS LLC et al". Archived from the original on 2018-01-21.

Further reading[edit]

External links[edit]