CYBCybersecurity

Fake Microsoft support: how to recognise the call and how a company stops it

The fake technician calls, announces a serious fault and asks you to install a remote support program. How to recognise the scam, which rules stop it in a company and what to do if it has already happened.

Strategic editorial team 18 March 2026 8 min read

Cover: “Fake Microsoft support: the phone call”, Cybersecurity

The fake Microsoft support scam is an unsolicited phone call. A so-called technician announces a serious problem with the computer and asks you to install a remote support program. From that moment the caller sees the screen and controls the computer as if they were sitting at the desk. The most effective defence is a written rule. No technician works on a company computer unless the company itself asked for support, through a known channel. Microsoft itself states that it does not make unsolicited calls to offer technical support.

How does the call go?

A typical scenario. It is nine in the morning in an administration office. The number on the display seems to belong to a big city, the voice is polite and the language is fluent.

Caller: Good morning, I’m calling from Microsoft technical support. We’re receiving reports of unusual activity from your computer. If we don’t act now, your data could be lost within the hour. Is anyone at the computer right now?

Employee: Yes, I am. What do I need to do?

Caller: Nothing complicated. Open your browser, type in the address I’m about to give you and download the program that lets me see your screen. Then read me the code that comes up, so we can check it together.

Those three lines contain every ingredient of the scam:

A name that inspires trust. Microsoft, the internet provider, the bank, the company that runs the ERP system.
Urgency. Data about to disappear, an imminent lockout, a virus “in progress”.
Something to do right now. Download a remote support program (AnyDesk, TeamViewer, UltraViewer and the like) and read out the connection code over the phone.

The program itself is not a virus. It is the same tool that many genuine technicians use, and that is precisely why antivirus software usually does not block it. In 2023 the US cybersecurity agency (CISA) described campaigns in which fake help desk messages led people to download “portable” versions of these tools. They start without being installed and get around the controls on approved software.

What happens once the connection is made?

Once connected, the fake technician works with the permissions of the person at the keyboard. They can open documents and shared folders, read email, recover passwords saved in the browser and install a second program to get back in later. A common variant is the fake refund. The technician asks to log in to online banking “to refund the cost of the call-out” and, while the screen is blacked out, sets up a bank transfer.

In a company the damage does not stop at that computer. From there, the ERP system, network folders and any cloud services open in the browser are all within reach. If the same password is used on several services, the access spreads. That is the mechanism described in our article on reused passwords.

Why does the scam still work in companies?

It works because it exploits strengths, not weaknesses: the helpfulness of someone who wants to fix a problem and respect for someone who sounds competent. On the phone, too, it is hard to take time to think. And in many organisations the support arrangements are muddled. There is one supplier for the network, one for the ERP system, one for the computers and sometimes a trusted local technician as well. If nobody knows for certain who is allowed to intervene and how, a well-acted call gets through.

There is also a reverse version, which is more insidious for larger companies. The scammer calls the internal help desk posing as an employee and asks for a password reset, or for two-factor authentication to be moved to a new phone. CISA and the FBI list it among the techniques of the group known as Scattered Spider, along with calls in which attackers pose as IT staff.

How do you recognise a fake call?

The signs are almost always the same:

The call comes in although nobody has reported a problem.
The tone is alarmed and rushed: “don’t hang up”, “in an hour it’ll be too late”.
You are asked to install a program, read out a code, turn off the antivirus or log in to your bank.
The caller avoids being called back on a known number.
The number on the display looks reliable, but caller ID can be spoofed and proves nothing.

Any one of these signs is enough to end the conversation. Hanging up is not rude. It is the procedure.

Which rules stop the scam in a company?

The rules that work are few, written down and known to everyone, not just to IT.

Support is requested by whoever needs it. No supplier works on a computer without a request opened by the company, with a reference the employee can check.
One approved remote support tool. IT chooses one, manages it centrally and blocks the others, including portable versions. It is one of the countermeasures recommended by CISA: a list of permitted programs and control over the ones that start up.
Call back on a known number. Anyone who receives a call “from support” hangs up and calls back the internal number or the one in the supplier’s contract.
No codes read out over the phone. Connection codes, codes received by text message and login notifications are never read out or approved on behalf of a caller.
Identity checks at the help desk. Resetting a password or two-factor authentication requires a procedure with a call-back or a manager’s confirmation, even when the request seems to come from a senior executive.
Users without administrator privileges. A program downloaded by mistake can then do much less harm.
A simple channel for doubts. Staff need a number or a mailbox they can use straight away, without worrying about being a nuisance. A needless report costs a few minutes. Silence can cost weeks.

The rules then need practice. Simulated calls and messages, run with management’s authorisation and with no intention of punishing anyone, show where procedures hold up and where they don’t. The same goes for scams that play on affection rather than fear, described in our article on phishing that uses love as the bait.

What should you do in the first minutes if the program has already been installed?

If the connection has happened, order and calm are what count:

Disconnect the computer from the network, both cable and Wi-Fi, without deleting anything. Switch it off only if you cannot isolate it. Its memory holds traces that will help whoever has to analyse it.
Alert IT or the security contact immediately, noting the time of the call, the number, what was asked and what was done.
Change passwords from another device, starting with those saved in the browser and the email passwords, and close any open sessions.
Call the bank if online banking was accessed or a payment was made, to block or dispute the transactions.
Don’t reinstall or “clean up” on your own. First you need to find out what was copied and whether the fake technician left other ways in.
Assess your obligations. If personal data is involved, the data controller decides with the data protection officer (DPO) whether to notify the supervisory authority within the 72 hours set by the GDPR, where feasible. Reporting the scam to the Polizia Postale, the Italian State Police’s cybercrime unit, is always advisable.

Microsoft’s guidance on tech support scams gives similar steps for individual users. Uninstall the programs you were told to install, run a full scan, change your passwords, apply updates and dispute any charges. A company also has to check everything that computer could reach.

In brief

Fake tech support calls out of the blue, creates urgency and asks you to install a remote support program.
The program is often legitimate. That is why antivirus is not enough, and rules are needed on who can use it.
In a company, support is requested by whoever needs it, with one approved tool and call-backs on known numbers.
Codes and notifications are never read out or approved on behalf of a caller.
There is also a reverse version, in which a fake employee calls the help desk to change a password or a two-factor setting.
If the connection has happened, isolate the computer, alert IT, change passwords from another device, call the bank and don’t clean up on your own.

Frequently asked questions

Can Microsoft call a company about a security problem?

According to its official guidance, Microsoft does not make unsolicited calls to offer technical support or to ask for personal or financial information. If you did not open a request yourself, end the call. If in doubt, call back your IT provider on its usual number or the one in your contract.

Are AnyDesk and TeamViewer dangerous programs?

No, they are legitimate tools used by many technicians. The risk arises when anyone can install them at anyone’s request. That is why it makes sense to choose a single approved tool, managed by IT, and to block the rest.

If the scammer was only connected for a few minutes, is the risk low?

Not necessarily. In a few minutes someone can copy saved passwords, install a second access program or create a task that reactivates later. The computer must be isolated and checked before it goes back into use.

Should we report it to the police?

It is advisable. In Italy the Polizia Postale also takes reports and complaints through its website. If payments were made, alert the bank immediately. If personal data is involved, the data controller assesses with the DPO whether to notify the supervisory authority. For businesses in San Marino the framework is different and needs to be assessed case by case.

Is staff training enough?

It helps a great deal, but it works better together with technical rules. With a single permitted support tool and users without administrator privileges, even one person’s mistake does more limited damage.

Fake technicians’ calls are stopped by a few written rules, approved support tools and people trained to recognise them. Strategic’s Cybersecurity division helps write these rules and prepares training and simulations for staff and senior management. When a suspicious connection has already happened, it reconstructs what took place. The contact form is not an emergency channel. During an incident, use the contacts written in your own plan.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.