Got a Fake Microsoft Support Call? What to Do in the First 30 Minutes

Your phone rings. The caller says they are from Microsoft. They know your name, mention a virus or “suspicious activity”, and tell you that your computer needs urgent attention. Then they ask you to download AnyDesk, TeamViewer, Quick Assist or another remote-access tool.

It can sound convincing, especially when the caller uses technical language or creates a frightening sense of urgency. But an unexpected call claiming that Microsoft has detected a problem on your computer is a major warning sign. Microsoft says it does not make unsolicited phone calls to provide technical support or request personal or financial information.

If this is happening right now, do not argue with the caller and do not try to “test” them. Hang up. The next 30 minutes matter because a scammer may be trying to obtain remote access, passwords, banking details, one-time codes or payment.

Quick answer: Hang up, do not install anything, disconnect the computer from the internet if you gave access or installed software, contact your bank immediately if money or banking details were involved, and change exposed passwords from a different trusted device.

Your first 30 minutes: the emergency checklist

Minute 0–2: Hang up immediately

Do not stay on the phone because the caller sounds professional. Do not press a number to “speak to a supervisor”. Do not give them a chance to transfer you to another person or make the story more believable.

Scam callers may spoof caller ID so the number looks familiar or legitimate. They may also tell you to look at normal Windows messages, Event Viewer entries or harmless system folders and present them as proof of an infection. A caller’s confidence is not evidence that they work for Microsoft.

Microsoft also warns that genuine Windows error and warning messages do not include a phone number for you to call. If the contact started with a pop-up, close the browser or use the normal operating-system controls to close it. Do not call the number displayed in the pop-up.

For a simple rule to share with family members: if a technology company contacts you out of the blue and asks for remote access, stop and verify independently.

Minute 2–5: Disconnect the computer if access was granted

If you only answered the call and did not install software, click a link or share information, the immediate device risk may be lower. End the call, delete the message or number and continue with reporting.

If you installed remote-access software, gave the caller a code, clicked “allow”, shared your screen or watched them move the mouse, treat the computer as potentially compromised:

• Turn off Wi-Fi or unplug the network cable.
• If possible, stop the remote session after the internet connection has been cut.
• Do not reconnect just to see whether the caller is still there.
• If the computer is showing encryption, files changing, unusual pop-ups or other active damage, leave it disconnected and seek urgent help.
• If it is a work computer, tell your manager or IT provider immediately and do not reconnect it to the business network.

Do not assume that closing the remote-access window removed the risk. A scammer may have installed other software, created a new user account, changed browser settings or copied information while they had access.

Computer Cures explains the warning signs and immediate actions in its guide to remote access scams. The guide also covers what to do after a scammer has controlled your screen.

Minute 5–10: Protect your bank accounts and payments

Contact your bank or card provider immediately if you:

• Read out your banking password, card number, PIN or one-time code.
• Logged into online banking while the scammer could see your screen.
• Approved a payment, transfer or new payee.
• Paid by card, bank transfer, gift card or cryptocurrency.
• Allowed the caller to access an account containing financial information.

Use the phone number printed on your card, statement or the bank’s official website. Do not use a number sent by the caller. Ask the bank what needs to be frozen, cancelled, replaced or monitored. Scamwatch advises acting quickly to stop further losses; recovery is not guaranteed, but early contact can reduce further harm.

Also check for unfamiliar transactions, new payees, changes to contact details and unexpected password-reset messages. Keep screenshots and transaction references for your bank and reporting agencies.

Minute 10–20: Change passwords from a clean device

Use a different computer or phone that you trust. If the scammer controlled your computer, changing every password on that same computer before it is checked may simply expose the new passwords too.

Prioritise accounts in this order:

1. Your primary email account
2. Banking, payments and shopping accounts
3. Your Microsoft, Google or Apple account
4. Work, business, cloud-storage and accounting accounts
5. Social media and messaging accounts

For each important account:

• Set a long, unique password that you have not used elsewhere.
• Sign out of unknown sessions and review recent login activity.
• Check recovery email addresses and phone numbers.
• Look for unfamiliar forwarding rules, browser extensions or connected apps.
• Turn on multifactor authentication.
• Do not approve login prompts that you did not initiate.

If you reused the exposed password, change it everywhere. If your email account was exposed, take it especially seriously: control of email can allow a scammer to reset other passwords and intercept security alerts.

If you are worried that your email has been accessed, follow Computer Cures’ guide on what to do if your email gets hacked.

Minute 20–30: Record what happened before cleaning up

Write down the details while they are fresh:

• Date and time of the call or pop-up
• Caller name, phone number and organisation claimed
• Websites visited and remote-access software installed
• Any passwords, codes or payment details shared
• Whether the caller accessed email, banking, files or social media
• New programs, browser extensions, user accounts or settings you noticed
• Any payments, transfers or unusual account alerts

Take screenshots only if it is safe and the device is not actively being controlled. Do not forward the scam link to anyone else. This record helps your bank, IT provider, police, Scamwatch or a technician understand the incident.

Should you uninstall the remote-access software?

Disconnect first. Then document what was installed and what the caller did. If you can safely remove the remote-access application without reconnecting the computer, Microsoft and Scamwatch both advise removing software that a scammer asked you to install. However, deleting AnyDesk, TeamViewer, Quick Assist or another tool does not prove that the computer is clean.

A professional check may be needed because the caller could have installed malware, changed security settings, created persistence, copied files or accessed saved browser credentials. Do not reset the computer immediately if the device contains important evidence or business data without first considering your recovery needs.

Computer Cures’ virus, spyware and malware removal service can assess the device, remove malicious software, repair damage and help check the backup system. The service page also explains common warning signs such as aggressive pop-ups, unusual browser changes, crashes, disabled security tools and unexplained emails.

What if you clicked a fake Microsoft pop-up but did not call?

Do not panic. A click alone does not prove the computer is infected. The risk is higher if you downloaded or opened a file, installed an app or extension, entered a password, approved a notification or gave someone remote access.

Close the page, stop any download, do not call the number and record the website or message if you need to report it. Then update the device and run a full security scan. If you entered a password or sensitive information, secure the account from a clean device.

For a more detailed step-by-step response, read what to do after accidentally clicking a malware link.

What if files are missing or encrypted?

Disconnect the affected computer and any shared drives. Do not keep restarting it, opening files or connecting backup drives to “see how bad it is”. If files have been renamed, encrypted or deleted, you may be dealing with ransomware or another serious compromise.

Do not pay a scammer or ransomware demand without first seeking professional and legal advice. Preserve the device and contact a specialist. Computer Cures provides ransomware data recovery and broader data recovery services in Melbourne for urgent file-loss situations.

Businesses should also check whether cloud storage, NAS devices, shared folders and backups were reachable from the affected computer. A backup that is connected and writable may also be at risk. Once the incident is contained, review your backup and disaster-recovery arrangements rather than assuming the existing backup is usable.

How to report a fake Microsoft support call in Australia

After protecting your money, accounts and device:

1. Report the scam to Scamwatch.
2. If money, personal information, accounts or a device were compromised, submit a report through the Australian Cyber Security Centre.
3. Contact IDCARE on 1800 595 160 for identity and cyber support if personal information was exposed.
4. Report the fake website or scam to Microsoft through its official reporting channel.
5. Tell family members, colleagues or your business team so they do not fall for the same caller.

Scamwatch reported that Australians lost $15.5 million to remote-access scams in 2023, and losses increased by 52% in the first three months of 2024 compared with the previous quarter. The figures show why a call that sounds “too small to worry about” is still worth reporting.

Source: Scamwatch’s remote-access scam alert, published 28 May 2024. Reported losses are historical figures from that alert, not a prediction of current losses.

How to avoid the next fake support call

• Remember that legitimate companies do not make unexpected calls to fix a computer they have not been asked to inspect.
• Never install remote-access software because of an unsolicited call or pop-up.
• Find support phone numbers independently from the organisation’s official website.
• Keep Windows, browsers, security software and applications updated.
• Use unique passwords and multifactor authentication.
• Keep reliable, tested backups that are not permanently connected and writable from every computer.
• Give older family members a simple instruction: hang up, then call someone they trust.

Frequently Asked Questions (FAQs)

Conclusion

A fake Microsoft support call is designed to make you panic and act before you think. You do not need to prove anything to the caller. Hang up, disconnect a device that may have been accessed, protect your bank accounts and change passwords from a clean device.

Then document the incident, report it and have the computer checked before returning to normal work or banking. Fast action can limit the damage, while a professional inspection can identify malware, unauthorised software and security changes that are not obvious on the screen.

If you are in Melbourne and think a caller accessed your computer, contact Computer Cures through the official website or call 13 0055 3166.