A tech support scam is a fraudster posing as support from a well-known company to convince a victim their device is infected, then charging for fake fixes or gaining remote access. It reaches people through pop-ups, cold calls, and search ads, disproportionately harms older victims, and often escalates into refund and remote-access scams.
What is a tech support scam, in plain English?
A tech support scam starts with a manufactured crisis: your computer is infected, your account is hacked, your files are at risk. The fraudster poses as support from a trusted brand, an operating system maker, a browser, an antivirus, or an internet provider, and offers to help. The problem is fake, but the fear is real, and that fear is what the scam runs on.
Victims are reached three main ways: a scary pop-up that freezes the browser with a warning and a phone number, a cold call claiming to have detected a virus, or a search ad that impersonates a real support line when someone looks up a help number. Once on the phone, the fraudster either charges for a worthless "fix" or, more dangerously, talks the victim into installing remote-access software that hands over control of the device.
From there it often escalates. With remote access, the fraudster can open the victim's banking, move money, or set up a refund scam where they pretend to overpay a refund and demand the difference back. Older victims are hit hardest, both because they are more often targeted and because the losses tend to be larger.
How a tech support scam unfolds
- Bait — Trigger the fear. A pop-up, cold call, or fake support ad convinces the victim their device is infected or compromised.
- Contact — Get on the phone. The victim calls the number or answers the call and speaks to a convincing fake support agent.
- Access — Install remote control. The agent talks the victim into installing remote-access software or paying for a bogus fix.
- Charge only — Fake fix fee. The victim pays for a useless service; loss is limited to the fee charged.
- Full access — Device takeover. Remote access lets the fraudster open banking, move money, and run a refund scam.
- Escalate — Drain or over-refund. Payments are demanded in gift cards or crypto, or a faked refund overpayment is clawed back from the victim.
Who is involved?
Who | Their role |
The fake agent | Poses as support for a trusted brand and drives the call toward access or payment. |
The impersonated brand | A well-known tech or antivirus company whose name lends the scam credibility. |
The victim | Often an older person who calls the number or lets the agent onto their device. |
The bank or platform | Sees the resulting payments, remote-session logins, or refund manipulation and can intervene. |
What it looks like in practice
In practice
An older customer is browsing when the screen fills with a flashing warning and an alarm sound, telling them their computer is infected and to call a support number immediately. They call, and a calm agent asks them to install a tool "to run a scan," which is really remote-access software.
With control of the screen, the agent opens the customer's banking, claims to process a refund, then shows a balance that looks like too much was returned. The agent insists the customer send back the difference in gift cards. The refund was staged, the overpayment was faked, and the gift-card codes go straight to the fraudster.
Why it matters to operators
Once a fraudster has remote control of a device, the activity comes from the customer's own machine and session, so device and location checks look clean. Payments are authorized by the customer, who has been convinced they are fixing a problem or returning an overpayment. That combination defeats a lot of standard controls and makes the outbound payment or gift-card purchase the key signal.
Because it targets older and more vulnerable customers, this scam also carries a duty-of-care and reputational weight. The strongest interventions are behavioral: spotting remote-access sessions during banking, unusual gift-card or crypto purchases, and refund-shaped transfers, then pausing to ask questions a scammed customer would struggle to answer.
What to watch for
- Remote-access during banking. Signs a remote-control tool is running while the customer logs in or moves money.
- Gift cards and crypto. Sudden purchases of gift cards or crypto by a customer who never buys them, framed as fixing a problem.
- Refund overpayment story. A customer sending money back to correct a refund they were told was too large.
- Coached transactions. The customer is clearly following instructions from someone on a call while transacting.
- Vulnerable targeting. Older customers making out-of-pattern payments after an unsolicited support contact.
Quick questions
Do real tech companies cold-call about viruses?
No. Legitimate providers do not call out of the blue to say your device is infected. Any unsolicited support call claiming to have detected a virus should be treated as a scam.
Why is remote access so dangerous?
It lets the fraudster operate the victim's device directly, so banking activity comes from the customer's own machine and session, bypassing device and location checks entirely.
What is the refund overpayment trick?
The fraudster pretends to refund money, fakes a screen showing too much was returned, then demands the difference back, often in gift cards. The refund never happened; the returned money is the victim's.
Why gift cards and crypto?
Both are fast and hard to reverse. Reading gift-card codes over the phone or sending crypto puts the money out of reach almost immediately.
Why are older people targeted?
They are more likely to trust an authoritative support agent and less likely to recognize the technical tricks, and they often hold larger balances, so the losses are bigger.
How can a bank intervene in time?
By flagging remote-access indicators and out-of-pattern gift-card or refund-shaped payments, then pausing to ask direct questions. A scammed customer usually cannot explain the payment clearly.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.