Tech Support Scam

A tech support scam is a fraud in which someone poses as technical or customer support for a company you might plausibly deal with, claims your device or account has a problem, and uses that claim to obtain money, remote access to your computer, or both. The FBI's Internet Crime Complaint Center reports it as "Tech/Customer Support Fraud" and defines it in one line: "Subject posing as technical or customer support/service." The Federal Trade Commission uses the plainer "Tech Support Scams" and files it as a subcategory of impersonation.

The structural feature that separates it from most other fraud is that the victim usually initiates the contact. A warning appears on screen with a phone number, or an advertisement or search result places a number where somebody looking for help will find it. That single inversion does a great deal of work, because a call you placed yourself feels like a call you controlled, and the ordinary defense of "never trust an unexpected caller" does not fire.

How the pretext is manufactured, in the FTC's own description. Tech support scams "often start with a bogus warning about a problem with your computer", which "could be a fake pop-up warning that looks like it's from a well-known company and urges you to call a phone number to get help." Others begin with a call or text from someone claiming to be a technician. And scammers "might also try to get their websites to show up in online search results for tech support or run their own display ads online. The scammers are hoping you'll call the phone number to get help." Once on the phone, they "ask for remote access to your computer and pretend to scan it for viruses. They claim to find a malicious program and offer to remove it for a fee."

Two things are worth separating there. The pop-up is not evidence of anything having happened to your machine; it is a web page, and a web page can display whatever it likes, including something that looks like a system dialog. And the seeded search result is the version most likely to catch a careful person, because it is found by someone who went looking, at a moment when they already believe they have a problem.

What remote access actually costs, which is more than the fee. Granting remote control hands over the ability to see anything on the screen, to open accounts that are already logged in, to install software, and above all to display things that are not true. From that point on, the "scan results", the "evidence" of a hack and the "refund confirmation" are all being produced by the person asking for money. The FTC records the refund variant precisely: a notice arrives about an automatic renewal of a tech support subscription, and if you call, the scammers "take you to a spoofed website that looks real and tell you to enter your bank or credit card information to process the refund. After you do that, they claim there was an error in the amount entered. They say they refunded you too much money and insist you pay them back with gift cards, a wire transfer, a bank transfer, cryptocurrency, or a payment app." No refund was ever made; the overpayment is a number on a page the operator controls. That mechanism, an apparent overpayment answered with a real one, is the subject of its own entry under the overpayment scam.

The escalation into a government impersonation scam, which is the most expensive version. The FTC describes it step by step: sometimes the fake specialist with remote access "claims to discover that someone hacked your accounts. Or that your name is linked to serious crimes, like money laundering or drug trafficking. That's when the tech support impersonator transfers you to someone who supposedly works for the government and can help you." That person supplies a badge number and a case number, both invented, and then says the money is at risk. What comes next is the tell, and the FTC states it as a rule with no exceptions attached: "someone who works for the government will never say you must transfer your money to 'protect it'", will never tell you to put money in a "federal safety locker", which does not exist, and "will never demand payment. Not in cash. Not in gold."

That pairing is not anecdotal. The FBI's 2025 Internet Crime Report treats Tech/Customer Support and Government Impersonation as the two categories of call center fraud, and reports that in 2025 the two together produced more than 80,000 complaints and losses exceeding $2.9 billion. The government half of the hand-off, including what actually makes impersonating an agency unlawful, is covered on our page on the government impersonation scam.

Scale, dated and attributed. In the FBI's 2025 figures, Tech/Customer Support drew 47,794 complaints and $2,134,675,818 in reported losses, which was the third largest loss of any crime type behind investment fraud and business email compromise. The age concentration is unusually sharp: of those, 21,333 complaints and $1,040,730,043 in losses came from complainants aged 60 and over, so people in that group accounted for a little under half the complaints and about half the money. These are complaints made to one system. The FTC's Consumer Sentinel network collects on a different basis and under different category names, so its figures are not comparable with the FBI's, and neither set is the total.

The sequence, and the reason each step is there.

1. A trigger the victim finds. A pop-up that mimics a system warning, a display ad, a search result, or an email about a subscription renewal. All carry a phone number, because a number is the only thing the operator needs you to use.
2. The call, placed by the victim. This is the inversion that makes the rest work.
3. Remote access. Granted to run a "scan". From here everything the victim sees is chosen by the operator.
4. A finding, and a fee. A malicious program, an expired license, an incorrect refund.
5. Payment on an irreversible rail. The FTC's list is gift cards, a wire transfer, a bank transfer, cryptocurrency or a payment app, and its explanation of why is exact: "it's like using cash: once you pay, it's hard to get your money back."
6. Escalation, in the expensive version. A discovered "crime", a transfer to a fake government official, and an instruction to move savings somewhere safe or to convert them to cash, gold or cryptocurrency.

A hypothetical example, and the arithmetic exists only inside the operator's window. An email says a tech support subscription has auto-renewed for $500 and gives a number to dispute it. The caller is talked through granting remote access and entering bank details on a page presented as the refund form. The operator then says the refund was typed as $5,000 instead of $500, so $4,500 has to be returned ($5,000 less $500), and asks for it in gift cards.

The point of the example is what is real and what is not. The $500 charge never happened, no $5,000 was ever credited, and the balance shown on screen is a page the operator built. The only genuine transfer in the whole sequence is the $4,500 the victim sends. A charge you can only see because somebody showed it to you is not a charge, and the check that settles it is opening your own account yourself, in your own browser window, after ending the call.

A tech support scam has no upside, so what follows is what defeats it and where the usual defenses do not reach.

What genuinely reduces exposure

• Never calling a number that appeared in the warning. The FTC's rule is that real security pop-ups and messages will never ask you to call a phone number, and a number inside an alert is the alert's purpose rather than a courtesy.
• Closing the browser or restarting the machine when a page will not close. A web page cannot damage a computer by being shut.
• Reaching a company on contact details you already had, from a receipt, a card or a statement, rather than from the message claiming there is a problem.
• Refusing remote access to anyone who contacted you, or whom you reached through a number you did not verify. The access is the product they came for.
• Checking a supposed charge or refund in your own account, opened yourself, after the call has ended.
• Reporting quickly if money moved. Some transfers can be stopped in the first hours, and the reporting routes are set out on our page on fraud.

What the protections do not reach

• A payment you were persuaded to send yourself, which sits on the authorized side of the line federal electronic-transfer rules draw.
• Gift card codes, cash handed to a courier, gold and cryptocurrency, none of which has any reversal mechanism whoever authorized it.
• Anything the operator saw or copied while connected, which is a separate harm with a separate remedy set.
• Credentials entered during the session, which should be treated as compromised and changed everywhere they were reused.
• Software the operator installed, which does not leave when the call ends.