Tech support and device scams
Tech support scams start with a problem that does not exist, then let you invite the attacker onto your own computer.
What it is
A tech support scam convinces you that your device is infected, compromised or being used for something illegal, and that a technician needs access to fix it.
Once you install remote access software, the operator controls the machine. From there the money comes from several directions: a support contract billed for hundreds of dollars, a refund that is deliberately over-paid so you send back the "difference", access to your online banking while you watch, or credentials taken quietly for later.
The distinguishing feature is that you grant the access. You call, or you accept the call, and you follow the steps yourself.
How it starts
A pop-up, most commonly. A full-screen browser page, sometimes with an alarm sound and a voice, warning that the device is infected and instructing you to call a number immediately. It often blocks normal browser controls, which feels like proof of infection.
Or a cold call claiming to be from Microsoft, Apple or your internet provider.
Or an email invoice for a subscription you do not remember buying, usually antivirus or a service at a few hundred dollars, with a number to call to cancel. This is the refund variant, and it is now more common than the pop-up.
The person on the phone is patient and technical. They will show you something alarming that is entirely normal: Windows Event Viewer warnings, running system processes, a netstat output. To someone unfamiliar with those tools, ordinary output looks like evidence.
Why it works
The evidence is real, and misread. Every Windows machine has hundreds of Event Viewer warnings. Displaying them and calling them infections is technically true and completely misleading.
Confusion converts to compliance. Being walked through unfamiliar steps by a confident expert produces deference, particularly when the alternative is admitting you do not follow.
The refund variant inverts the emotion. Nobody is threatening you. Someone is giving you money back. When the refund is "accidentally" over-paid by several thousand dollars, the natural reaction is to help fix their mistake. That number was never real; the balance shown was edited on the screen you were looking at.
Access is broad and permanent until removed. Remote software does not scope itself to one task. Saved passwords, email, banking sessions and files are all reachable, and the session can be reconnected later.
A shameful mistake goes unreported. People who have handed over their computer are less likely to tell anyone, which extends the window for the operator to use what they took.
How to spot it
Any pop-up giving you a phone number to call. Microsoft, Apple and Google never do this
An unsolicited call about a problem with your computer
An invoice for antivirus or a service you do not recall, with a phone number and no way to check the account online
You are asked to install AnyDesk, TeamViewer, UltraViewer, LogMeIn or similar
You are asked to log into your bank so a refund can be processed
A refund arrives over-paid and you are asked to return the difference by gift card, crypto or wire
Payment is requested by gift card. No software company bills that way
You are told not to hang up or not to touch the keyboard
What to do
A pop-up is only a web page. Close the browser. If it will not close, force-quit it: Task Manager on Windows, Force Quit on Mac, or restart. Nothing was infected, and nothing needs a phone call.
Never call a number that appeared on your screen. Find the company's own support number on its website.
If you gave remote access. Disconnect from the internet immediately. Uninstall the remote software. Run a full scan with your existing security software. Then change passwords from a different device, starting with email and banking, and turn on two-factor authentication. Assume anything visible during the session was seen.
If you paid. Card payments can often be disputed. Gift cards should be reported to the issuer straight away with the receipts, since occasionally funds are still recoverable. Report to the FTC at reportfraud.ftc.gov.
If you sent back an over-payment. Tell your bank the transfer was obtained by deception. The original credit was moved between your own accounts, not paid in, so the loss is the amount you sent.
---
Have this emailed to you
Send yourself this page so you can forward it, or read it later when you are not standing in a shop.
Email it to myselfPaste a text, email or direct message
A text, an email or a chat message. Take out names and account numbers first.
Add a screenshot
Check it
No account needed.
What happens to your message
Checking the message now. Stay on this page.
Flggd could not check this message just now. Try again in a moment, or use the Flggd app.
Try again
Flggd could not read this image, so it has not been checked. This is not a verdict. Try a clearer screenshot, or paste the text instead.
Paste a message or add a screenshot first.
Text Submission
Image Submission
Flggd Verdict
Scam
Red flag
High confidence of a scam. The content, the sender, the intent and where its requests lead all point the same way. Do not reply, click, call or pay.
Likely to be a scam
Yellow flag
It asks you to act: a link, a number, a reply or a payment. Where that request leads is where the harm starts.
Looks normal
Green flag
High confidence this is normal. The content reads as expected, the sender has a safe history, and anything it asks leads somewhere legitimate. Accounts can be taken over, so if a request seems out of character, check again.
Likely to be a scam
Grey flag
Nothing is asked of you yet. The content, the sender or the intent do not add up. Scams like this start friendly and ask later.
This result could not be shown. Check the message again. If it happens twice, use the Flggd app instead.
Score
Scam type
Confidence
Why Flggd says this
What this message wants you to do
Has anything happened yet?
You do not have to answer. Nothing you tap here is sent or recorded, and the verdict above stands either way.
Change answer
Nothing has happened yet
Good. Checking first is the safest thing to do. Do not tap any link, reply, or call any number in the message. Block the sender and delete the message. If it claims to be from an organisation you know, contact them using details you already trust.
Change answer
You tapped a link
Opening a link does not usually take money or details on its own. The harm comes from what you do on the page it opens. If you entered nothing and installed nothing, close the page and do not go back to it. If it asked you to sign in, enter a code, or install something, and you did, choose Gave details instead.
Change answer
You gave details
Work through this in order. First, if you gave bank or card details, call your bank now on the number on your card. Next, change the password for any account you entered, and for any other account that uses the same password. If you shared a one-time code, tell the organisation it belongs to straight away. Then turn on two-step verification where you can, and watch your statements for anything you do not recognise.
Change answer
You sent money
Call your bank now, on the number on your card or in your banking app. Say: "I have been scammed and I need to stop a payment." The sooner they hear from you, the more they may be able to stop or recover. In the UK you can call 159 to reach your bank. Do not pay anyone who offers to get the money back. That is another scam.
Report it. US: ReportFraud.ftc.gov, and ic3.gov for online crime. UK: reportfraud.police.uk or 0300 123 2040; in Scotland, Police Scotland on 101. Australia: scamwatch.gov.au. Have ready the message, the sender's number or address, and any payment details.
What to do next
Do not reply, click any link, call any number in the message or send money. If it claims to be from an organisation you know, contact them using details you already trust.
Do not reply, click any link, call any number in the message or send money. If it claims to be from an organisation you know, contact them using details you already trust.
No action needed. If the sender later asks for money, codes or personal details, check that message too.
Do not reply at all, not even to say wrong number. A reply tells them the number is live. Block the sender and delete the message. If a request follows, check it again.
Text read from your image
Your image
The closest scam in the Flggd library. Similar, not necessarily the same message.
How this scam works
The closest match is the scam described on this page.
Share this result
Email it to myself
Copied. Paste it anywhere to share it.
Could not copy. Select the text and copy it, or use Email it to myself.
Checked with Flggd at flggd.com
My Flggd verdict
Check the next one on your phone
The Flggd app checks texts, emails and screenshots wherever you are, and teaches you the warning signs as you go. Free on iPhone and Android.
Get the app
What Flggd does about this
Worried about someone else rather than yourself?
Helping someone else
