Fake tech support calls: what staff should do when the phone rings

How the call usually goes

The caller is polite, confident and often has a convincing accent and background noise that sounds like a call centre. They say they've detected a virus on your computer, unusual traffic from your internet connection, or a problem with your Microsoft licence. They ask you to go to your computer so they can 'take a look'.

The next step is getting you to install a remote access tool, sometimes a legitimate one used by real IT teams, by visiting a website and typing a short code. Once connected, they can see your screen and control the mouse. They may open system tools full of harmless warnings and claim they're evidence of infection, then ask for payment, a card number or online banking access to 'fix' it.

The newer version: pretending to be your IT team

Attackers increasingly call staff pretending to be the company's own IT provider. They might first flood someone's inbox with junk email, then ring offering to help sort out the spam. Because the problem is real, the call feels helpful rather than suspicious. Others use names from LinkedIn to sound like they know the business.

The goal is the same: get a remote session or get the staff member to approve a multi-factor sign-in prompt or read out a code. With that, the attacker can access email, files and sometimes the whole network. This is how several serious ransomware attacks overseas started, so it's worth taking seriously even in a small office.

Simple rules for staff

Microsoft, Apple and internet providers do not ring customers out of the blue to report viruses on their computers. Your bank won't ask you to install software or move money to keep it safe. If an unexpected caller asks for remote access, a code, a password or payment, the answer is no, however urgent they make it sound.

For calls claiming to be from your own IT provider, agree a way to confirm them. That could be calling back on the help desk number you already have, checking for a matching ticket, or a simple rule that IT will only ask for remote access on a request the staff member raised themselves. Write this down so new staff know it from their first week.

How a genuine IT provider should behave

A good IT provider makes verification easy rather than taking offence. They should be happy for staff to hang up and call back, they should reference a ticket or request the staff member recognises, and they should never need a person's password, because administrators can reset it themselves. They should also use one consistent remote support tool, so staff can learn what a genuine session looks like. If your current setup means staff can't easily tell a real IT call from a fake one, fix that first. A short one-page guide on how support contacts you, what tool they use and what they will never ask for removes most of the uncertainty that scammers rely on.

If someone has already given access

Disconnect the computer from the network straight away by unplugging the cable or turning off Wi-Fi, and switch it off if you aren't sure. Don't log in to anything else from it. Tell your IT contact immediately so they can check what was installed, what the caller could see and whether any accounts need resetting.

Change the passwords for any accounts used on that computer, using a different, trusted device. If card or bank details were shared, call the bank. Report the call to the NCSC, and if possible note the phone number used, the time and what was said, which helps others avoid the same caller.

Reducing the damage if a call gets through

Technical controls limit what a scammer can do once they're on a computer. Staff accounts without local administrator rights can't install most software, which blocks many remote access tools. Endpoint protection can flag unusual remote sessions, and device management can block remote access apps that your IT team doesn't use. Multi-factor sign-in that requires a number match or a physical key also makes it harder for a caller to trick someone into approving a sign-in. These controls don't replace staff awareness, but they turn a scam call from a disaster into an inconvenience.

Pop-up warnings that ask you to call

A related scam starts on screen rather than on the phone. While browsing, a page suddenly fills the screen with flashing warnings, a loud alarm and a message saying the computer is infected and you must ring a support number immediately. The page may even appear to lock the browser so it can't be closed easily. These pages can't actually see inside your computer. Close the browser using Task Manager on Windows or Force Quit on a Mac, or simply restart the machine. Never ring the number shown. If you're worried, tell your IT contact, who can check the device properly.