Fake virus warning? How to spot a tech support scam

This guide is for anyone who saw a frightening window claiming the computer was hacked, or got a call from someone presenting themselves as technical support. You will learn to recognize the scam, close the window without damage, and what to do if you already gave them access or paid.

What does a fake virus warning look like?

The surest sign: a phone number. According to Microsoft, its error and warning messages never include a phone number. A window that asks you to call is a scam, even if it carries a Microsoft or Windows logo.

More signs that keep appearing in these messages:

• The browser goes full screen, and it looks like it cannot be closed.
• An alarm or a voice message plays.
• It says the computer is “locked”, your passwords were “stolen” or your bank account is “at risk”.
• There is a countdown clock, or a warning “do not turn off the computer”.
• The Hebrew or English is sometimes garbled, like an automatic translation.

All of these are designed for one thing: that you panic and call before you think.

And note the difference: a real Windows error, like a blue or black screen with a stop code, does not ask you to do anything except wait for the computer to restart. It has no phone number, no payment link and no alarm. What the real screen does say is explained in the guide about the blue screen in Windows.

Does Microsoft call when there is a virus on the computer?

No. Microsoft states explicitly that it does not call or email people who did not ask. It also never asks for payment for support in gift cards or in digital currencies like Bitcoin.

The same rule works for any surprise call, including from someone presenting themselves as your internet provider, your bank or a security company: if you did not make the contact, hang up. If in doubt, call the official number on the website or on your bill yourself, not the number you were given in the call.

How do you close the window without calling?

Without clicking anything inside the window, including buttons like “Close” or “Cancel”. They can be part of the page. This is how to close it safely:

1. Press Esc, or F11, to leave full screen.
2. If that does not work, press Ctrl+Shift+Esc to open Task Manager.
3. In the Processes tab, select the browser, for example Google Chrome or Microsoft Edge, and click End task.
4. When you open the browser again, it may offer to restore the previous tabs. Do not restore.
5. Check whether any site was given permission to send you notifications. In Chrome it is at chrome://settings/content/notifications, and in Edge at edge://settings/content/notifications. Delete every site you do not recognize. That permission lets a site pop the messages up again, even when it is closed.
6. Run a full scan: Windows Security > Virus & threat protection > Scan options > Full scan.

How does the scam with AnyDesk or TeamViewer work?

The scam is built like a real support call, and that is what makes it convincing. The common scenario:

1. The agent asks you to install remote control software, such as AnyDesk, TeamViewer or Quick Assist which is built into Windows, and to read them the code.
2. From that moment they see your screen and control the mouse. They open system windows with red lines and present them as “proof” of a hack. These are usually ordinary entries that exist on every computer.
3. They ask for payment for a “cleanup” or a “protection subscription”, sometimes in gift cards or digital currency.
4. In another version they promise a “refund” and ask you to sign in to your bank account to receive it. When you are signed in to the bank and they control the computer, they can see the screen and try to carry out transactions.

It takes them a few minutes. So the rule is simple: do not install remote control software at the request of someone you did not contact yourself.

Decision table: what happened and what to do now

I already gave them access or paid. What now?

The money first, then the computer. In order:

1. Disconnect the computer from the internet. Turn off the WiFi or unplug the cable. That also cuts off the remote control.
2. If you paid or signed in to the bank, call the bank and the credit card company immediately. Tell them what happened and ask to block or cancel the charges. Microsoft recommends contacting the credit card company to dispute the charges if you already paid.
3. Change passwords from another device, for example your phone. Email first, because through it everything else can be reset. Then the bank, your Microsoft account and every account you signed in to during the call. Turn on two-step verification everywhere you can.
4. Remove the remote control software. Open Settings > Apps > Installed apps, and sort by install date. Remove everything that was installed during the call, especially AnyDesk, TeamViewer, UltraViewer or RustDesk, if you do not use them yourself.
5. Scan the computer. A full scan, followed by a Microsoft Defender Offline scan from the same screen in Windows Security.
6. Report. Details in the next section.

If the computer keeps behaving strangely after all this, Microsoft recommends considering a reset of the computer. Before that, back up your files following the guide to backing up the computer.

Who do you report to in Israel?

The 119 hotline of the Israel National Cyber Directorate. You can dial 119, the hotline operates 24 hours a day, or fill in the cyber incident report form on gov.il. Anyone who lost money can also file a complaint with the police. You can report the scam to Microsoft at microsoft.com/reportascam.

How do you protect in advance, including your parents?

The best protection is knowing in advance that the scam exists. A few simple steps:

1. Tell the older adults in the family about it. One sentence is enough: “A real computer never asks you to call. If a phone number appears, call me.” Stick your number next to the computer.
2. Keep Windows and the browser updated. Updates close security holes, and Microsoft notes that Edge blocks known scam sites with Microsoft Defender SmartScreen and can stop pop-up loops.
3. Download software only from official sources. From the Microsoft Store or the manufacturer’s website, not from a link that arrived in a message.
4. Look up support numbers only on the company’s official website, not in a search result or an ad.
5. Set yourself a rule: nobody gets control of the computer unless you contacted them first.

What not to do?

• Do not call the number shown in the window.
• Do not install an “antivirus” from a link you got in the window or in the call. The Windows Security already on the computer is enough for the first scan.
• Do not install remote control software at the request of someone you do not know.
• Do not pay in gift cards or digital currency. No real company asks for that.
• Do not be embarrassed. These scams are deliberately built on pressure and panic. Reporting quickly to the bank improves the chance of stopping a charge.

When to bring the computer to the lab

When someone controlled the computer remotely, even if everything looks fine. While they had access they could have installed more software, created users or changed settings. Also when the window keeps coming back after closing, or when the computer has been slow and odd since the incident. In that case it is worth checking the guide about a slow computer and the guide about signs of a virus too.

With us it starts with a diagnosis: we check what was installed, remove remote control tools and unwanted software, and explain what else needs checking. You get a price before we start.

Did it not work out?

The goal is for you to recognize the scam yourself and close it without damage, and most of the time that really is possible. If someone was already inside the computer, or you are not sure it is clean, we will check what was installed and close the access they left behind. You can start from the virus removal and slow computer page.