What a tech support scam call actually sounds like

I promised in the first post that I would write this one, so here it is.

Nearly every week somebody describes the same phone call to me, and they describe it apologetically — as if nearly falling for it says something about them. It does not. These calls are written by people who do this full time, and they are written to work on careful people having a bad afternoon.

So here is the call, in the order it usually happens.

How it opens

There are two doors in.

The first is the phone ringing. Somebody says they are from Microsoft, or Apple, or "the Windows security department," or increasingly your own internet provider. They say your computer has been sending them error reports. They may have your name. They may know roughly where you live. None of that is hard to get and none of it means anything.

The second is a pop-up. You are reading something ordinary and the screen fills with a warning — often with a siren noise, often claiming your machine is locked or infected, always with a phone number to call. The number is the whole point of the pop-up. Everything else on it is scenery.

What they ask for next

The call always moves toward one of two things.

Remote access. They want you to install something so they can see your screen. The names change — AnyDesk, TeamViewer, LogMeIn, UltraViewer, whatever is current. These are real programs, used honestly by real technicians, me included. That is exactly why they work: nothing about the installer looks wrong, because nothing about it is wrong. What is wrong is who is on the other end.

Once they are in, they will show you something alarming. Usually the Windows Event Viewer, which lists routine warnings on every healthy computer on earth, presented as proof of catastrophe. It is theatre, and it is convincing theatre.

Payment in a form that cannot be reversed. Gift cards. A wire transfer. Crypto. Sometimes a "refund" where they claim to have accidentally sent you too much money and need you to send the difference back — the overpayment never happened, they just edited what your browser was showing you.

No real company has ever been paid in gift cards. Not once, in the history of commerce. If gift cards enter the conversation, the conversation is a crime in progress.

The tells, if you want a checklist

Urgency. Real problems wait for you to finish dinner.
They called you, or a pop-up gave you the number.
They want remote access before they have told you anything specific.
They ask you to stay on the line while you go to the store.
They tell you not to discuss it with your bank, your spouse, or your son.
The reason you cannot hang up keeps changing.

That last one is worth sitting with. If somebody's answer to "let me call you back" is a new reason every time, you already have your answer.

Hanging up costs nothing

This is the part I most want people to keep.

There is no scenario where ending the call makes things worse. If — in the vanishingly unlikely event — it was a real company, they will still exist in ten minutes and you can reach them at a number you looked up yourself. If it was not, you just ended it.

You do not have to be polite. You do not need an excuse. You do not owe a stranger who called your house an explanation. Put the phone down.

And if there is a pop-up on the screen: do not click anything on it, including the X. Quit the browser entirely — Command-Q on a Mac, or Alt-F4 on Windows — or just restart the machine. When the browser reopens, decline to restore the previous session.

If you already let them in

This happens. It happened to a client of mine who has more degrees than I do. Move in this order:

Disconnect the machine from the internet. Unplug the cable, or turn off wifi. That ends their access immediately, mid-session.
Call your bank from a different device — your phone, not the computer they touched. Tell them what happened. If money moved, say so in the first sentence; the reversal window on some transfers is measured in hours.
Change your email password first, also from a different device. Email is the master key — whoever holds it can reset everything else.
Then change the rest, starting with anything financial.
Assume the machine needs work. Whatever they installed is still there, and "I uninstalled the remote program" is not the same as the machine being clean.

Then, if it helps, tell somebody. The shame around this is the reason it keeps working; people do not warn each other because they are embarrassed.

What I do about it

If you get one of these and you are not sure, call me and describe it. I will tell you straight away whether it is real. That is a two-minute phone call and I do not charge for it — I would much rather spend two minutes on the phone than a morning cleaning up afterward.

If somebody did get in, that is a real job and I will quote it before I start, same as anything else. If money is involved and the trail is still warm, say URGENT when you get in touch and it moves up the list.

Call (503) 567-5975 or email support@ironwood.help.