Microsoft Tech Support Scam UK

Variant 1 — Cold call: “your computer is infected”

How it presents: An unsolicited phone call. The caller claims to be from “Microsoft Technical Department”, “Windows Security”, or sometimes “Microsoft’s partner in the UK”. They tell you your computer has been infected with malware / your Windows licence has expired / your IP address has been compromised. To “fix” the issue they need you to install a remote-access tool (typically AnyDesk, TeamViewer, UltraViewer) and grant them access.

Red flags:

• Microsoft does not cold-call customers. Ever. Real Microsoft has no way to know your phone number or to identify your computer is infected. There is no monitoring mechanism that does this.
• Requests to install AnyDesk / TeamViewer / UltraViewer / LogMeIn / Quick Assist. Once installed, the criminal has full control of your computer. Real Microsoft support uses its own Quick Assist within Windows or its own remote tools — never asks you to download an external third-party tool.
• Reference to your Windows version or computer details. The caller may say things like “Your Windows 11 PC has been compromised”. They’re guessing — nearly all UK home computers are Windows. The reference is psychological, not based on real telemetry.
• They will eventually ask you to open your online banking. Once remote access is established, the criminal either watches you enter credentials, screen-blocks while they transfer funds, or shows fake “refunded too much” figures to set up Variant 3 (the reverse refund scam).
• Foreign accent + UK phone number. Spoofed caller ID combined with operators in lower-cost regions is the standard operating model. Not diagnostic on its own, but combined with other signals it’s consistent.

Variant 2 — Browser pop-up: “Windows Defender Security Alert”

How it presents: While browsing (often after clicking a suspicious link, watching streaming videos on a sketchy site, or visiting compromised sites), a full-screen browser pop-up appears: “WINDOWS DEFENDER SECURITY ALERT”. Audio plays, often a panicked voice or an alarm tone. The page lists a phone number and says “DO NOT shut down your computer — call Microsoft support immediately on 0800-XXX-XXXX”.

Red flags:

• Windows Defender does not display security warnings in your web browser. Real Windows Defender alerts appear in the Windows notification area at the bottom right of the screen, not as a full-screen browser page.
• Real Microsoft alerts never include a phone number. Microsoft does not display phone numbers in any security warning, ever.
• The page tries to prevent you from closing it. Fake alert pages use full-screen API tricks, repeated alert pop-ups, or audio to discourage you from closing the tab. None of this is part of real Windows behaviour.
• If you call the number, the script begins. The same remote-access install demand as Variant 1.
• To close the page: press F11 to exit full-screen, then close the tab. If the page resists, press Ctrl+Alt+Delete and end the browser process. Restart the browser without restoring the previous session. The pop-up has no persistence beyond the page itself.

Variant 3 — Reverse ‘refund’ scam: “we refunded too much, please wire the difference back”

How it presents: Following a previous tech-support scam interaction (or sometimes as a standalone), the “Microsoft refund department” contacts you saying you’re entitled to a refund. They ask you to log in to your online banking to receive the refund. While remote-accessing, they manipulate the display to show a £5,000 refund instead of the £500 they claim to have intended. They then claim they’ve refunded too much and ask you to wire the difference (£4,500) to a foreign account or buy gift cards to repay.

Red flags:

• Microsoft does not refund customers via remote-access banking sessions. Real refunds go through your original payment method automatically.
• The displayed bank balance is manipulated, not real. Remote-access tools allow the criminal to show a doctored view of your banking page. The “extra refund” never existed; the money you’re asked to send is your own.
• Foreign wire / gift cards / crypto are the diagnostic payment route. No legitimate refund-correction process uses these channels.
• Urgency about “the supervisor losing his job”. Emotional manipulation is standard. The script invokes sympathy: “the supervisor will be sacked”, “I’ll personally have to repay it”.
• The scam targets the elderly disproportionately. Variant 3 is among the highest-loss-per-victim scam patterns in UK reporting. Talk to older relatives about it specifically.