Fake Support

A caller pretends to be an employee of an IT company (typically Microsoft) and tells the victim that their computer is infected and needs to be restored. A software needs to be installed to do this.

The alleged support callers phone people randomly. They have no idea of the configuration of the computers of the people they are calling. The cyberattackers want to trick the victims into downloading a program that will allow them to access their computer. When they gain access to the system via this program, they can manipulate the computer of the victim. In most cases, the callers also try to sell the victims a software licence or service ("system cleaning") by asking their credit card information.

Specific measures

• End such phone calls immediately. Neither Microsoft nor other software companies make unannounced or unsolicited support calls to resolve computer problems.
• Do not allow anyone to remotely access your computer. If you gave remote access, it is possible that your computer has been infected. The first step is to uninstall the remote access program.
• If you suspect an infection, have your computer checked immediately by a specialist and cleaned if necessary. The safest option is to completely reinstall the computer. However, do not forget to back up all personal data beforehand.
• If you provided credit card details, contact your credit card company immediately to have the card blocked.
• Do not make any banking transaction or online purchase with your credit card on the affected computer until you are sure that it is free of malware.
• Change any passwords that the caller may have obtained via the remote control software.
  

Preventive measures

• In general, be sceptical about phone callers that require action from you and otherwise threaten with consequences (loss of money, criminal charges or legal proceedings, account or card blocking, missed opportunity, misfortune).
  

Effects and risks

• Attackers have full access to the computer
• Attackers can also access the computer at a later date
• The fraudsters are in possession of the credit card data
  

Further Information

• Microsoft is taking action against this phenomenon and has created a specific website for reporting such incidents: https://www.microsoft.com/en-us/concern/scam.
  

Last modification 14.12.2020