Microsoft scams
Last updated September 18, 2026
The short answer
The Microsoft scam is a screen-filling warning that your computer is infected, with a phone number to call. Microsoft never puts a phone number in an error message, never calls you about a virus, and never needs remote access to a computer you did not ask them to look at.
Microsoft impersonation is the backbone of the tech support scam industry, and it works for a structural reason: nearly everyone has a Windows computer, so a caller or a pop-up does not have to know anything about you to be right. The script has been refined over fifteen years and is run at industrial scale from call centres. It has a well-documented second act — the refund scam — that returns to the same victim months later and takes far more than the first attempt did.
How Microsoft scams work
- 1
The warning that will not close
A web page fills the screen with a Windows Defender-styled alert, often with an alarm sound and a locked browser tab. It says your computer is infected and gives a support number. The page is only a web page; the lock is a JavaScript trick.
- 2
The call and the "diagnosis"
The person who answers sounds like support. They walk you to Event Viewer or the netstat command and present ordinary warnings and connections as proof of infection. Both are normal on every Windows machine ever made.
- 3
Remote access
They ask you to install AnyDesk, TeamViewer, UltraViewer or similar so they can "clean" the machine. Once connected they can see and do everything: read files, install software, open your banking session, and watch you type.
- 4
The charge, then the refund scam
A "support plan" is sold for $200 to $1,000. Months later the same operation calls back offering a refund because the company is closing. During that call they appear to overpay you — a number typed into a page under their control — and ask you to return the difference in gift cards or a transfer. The second act takes more than the first.
Warning signs
- A pop-up says your computer is infected and shows a phone number
- The browser tab will not close, or plays an alarm
- A caller says they are from Microsoft and detected a problem
- You are asked to install remote-access software
- Event Viewer warnings or netstat output are shown as proof of a virus
- You are asked to log into your bank while someone is watching your screen
- A refund is offered and then said to have been overpaid
- Payment is requested in gift cards or by wire
Examples
The locked browser
A mistyped URL loads a page that fills the screen with a Defender warning and a siren, and the tab will not close. The number connects to a "certified technician" who takes remote control, opens Event Viewer, points at routine warnings, and sells a $399 three-year protection plan. Pressing Ctrl+Alt+Delete and ending the browser from Task Manager would have ended it in ten seconds.
The refund that took $8,000
Eight months after paying $299 for a fake support plan, a retiree is called back: the company is closing and owes him a refund. On the remote session the "refund" appears as $8,000 rather than $800 — a number typed into a page the caller controls. Distraught, the "agent" asks him to return $7,200 in gift cards. He does, across four shops in one afternoon.
What to do
- Never call a number from a pop-up. Close the browser with Task Manager (Ctrl+Shift+Esc) if the tab will not close.
- Never install remote-access software for someone who contacted you.
- If you gave remote access: disconnect from the internet, uninstall the remote tool, run a full Windows Defender scan, and change every important password from a different device.
- Call your bank if any financial site was open during the session, and ask them to review recent activity.
- Expect a refund call months later from the same people. It is never real, and it is the expensive half.
- Report it to Microsoft at microsoft.com/reportascam — they act on these and pass them to law enforcement.
Report it to Microsoft
Report tech-support impersonation at microsoft.com/reportascam. Microsoft never puts a phone number in an error message.
Getting your money back
Treat a remote-access session as a full compromise: disconnect, remove the remote tool, run a full scan, and change passwords from a different device starting with email and banking. A machine that was accessed for any length of time is a candidate for a clean reinstall, because these sessions routinely leave persistence behind. Card payments for a fake support plan are disputable as services not rendered. Gift card losses should go to the issuer immediately with numbers and receipts — a small share is recovered when the balance is unspent. Most importantly, write down that a refund call is coming and that it is the same people: knowing that in advance is what prevents the larger loss.
Frequently asked questions
Does Microsoft ever call people about their computer?
No. Microsoft does not make unsolicited calls about viruses, licences or performance, and it does not display phone numbers in error messages or security warnings. Any call or pop-up offering support you did not request is a scam.
A pop-up has locked my browser. How do I get rid of it?
Open Task Manager with Ctrl+Shift+Esc and end the browser process, or force-quit it. Reopen the browser without restoring the previous session. Nothing was installed and nothing is wrong with the computer — the page was only ever a web page.
I let someone access my computer. What should I do first?
Disconnect from the internet, then uninstall any remote-access software (AnyDesk, TeamViewer, UltraViewer and similar), run a full malware scan, and change every important password from a DIFFERENT device — assume anything typed during the session was captured. Call your bank if any financial site was opened.
Why do they call back months later offering a refund?
Because it works, and because they already know you paid once. The refund call is the second and more damaging act: during it they control what you see on your own screen, manufacture an overpayment, and ask you to return money that was never sent. Expect it, and hang up.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Microsoft, these are the guides worth reading next.