A technical support scam, or tech support scam, is a type of scam in which a scammer claims to offer a legitimate technical support service for computing devices connected to the Internet. The scam may be intimated by a cold telephone call from the thief to the victim, or victims may contact scammers in response to a fake pop-up resembling an error message, or via fake "help lines" advertised on websites operated by the scammers.
Technical support scammers use social engineering and a variety of confidence tricks to persuade their victim of the presence of problems on their computer or mobile device, such as a malware infection, when there are no issues with the victim's device. They frequently take full control of the victim's computer with remote control software.
The scammer will then persuade the victim to pay to fix the fictitious "problems" that they claim to have found. Payment is made to the scammer via gift cards or cryptocurrency, which are hard to trace and have few consumer protections in place. There is risk of potentially higher losses to thieves who persuade victims to connect, with password and two-factor authentication if relevant, to online banking, or to transfer large sums to a "safe account" to "protect it from hackers accessing their computer". Technical support scams started no later than 2008.
A 2017 study of technical support scams found that of the IPs that could be geolocated, 85% could be traced to locations in India, 7% to locations in the United States and 3% to locations in Costa Rica. Research into tech support scams suggests that millennials and Gen Z have the highest exposure to such scams; however, it is thought that older people are more likely to fall for these scams and lose money to them.
Technical support scams were named by Norton as the top phishing threat to consumers in October 2021; Microsoft found that 60% of consumers who took part in a survey had been exposed to a technical support scam within the previous twelve months. Responses to technical support scams include lawsuits brought against companies responsible for running fraudulent call centres, and scam baiting.
Origin and distribution The first tech support scams were recorded in 2008. Technical support scams have been seen in a variety of countries, including the United States, Canada, United Kingdom, Ireland, The Netherlands, Germany, Italy, Australia, New Zealand, India, and South Africa.
A 2017 study of technical support scams published at the NDSS Symposium found that, of the tech support scams in which the IPs involved could be geolocated, 85% could be traced to locations in India, 7% to locations in the United States and 3% to locations in Costa Rica. In 2020, scambaiter Jim Browning said that 95% of the scammers he has interacted with have Indian IP addresses.
India has millions of English speakers who are competing for relatively few jobs. One municipality had 114 jobs and received 19,000 applicants. This high level of unemployment serves as an incentive for tech scamming jobs, which are often well-paid. Additionally, scammers exploit the levels of unemployment by offering jobs to people desperate to be employed.
Many scammers do not realise they are applying and being trained for tech support scam jobs, but many decide to stay after finding out the nature of their job as they feel it is too late to back out of the job and change careers. Scammers are forced to choose between keeping their job or becoming jobless. Some scammers convince themselves that they are targeting wealthy people that have money to spare, which justifies their theft, whilst others see their job as generating "easy money". Some scammers rationalize that the victim needs an anti-virus anyway and therefore, it is acceptable to tell the victim lies and charge them for technical support or to charge them for an anti-virus.
Operation Technical support scams rely on social engineering to persuade victims that their device is infected with malware. Scammers use a variety of confidence tricks to persuade the victim to install remote desktop software, with which the scammer can then take control of the victim's computer. With this access, the scammer may then launch various Windows components and utilities (such as the Event Viewer), install third-party utilities (such as rogue security software) and perform other tasks in an effort to convince the victim that the computer has critical problems that must be remediated, such as infection with a virus. Scammers target a variety of people, though research by Microsoft suggests that millennials (defined by Microsoft as age 24–37) and people part of generation Z (age 18–23) have the highest exposure to tech support scams and the Federal Trade Commission has found that seniors (age 60 and over) are more likely to lose money to tech support scams. The scammer will urge the victim to pay so the "issues" can be fixed.
Initiation
Technical support scams can begin in a variety of ways. Some variants of the scam are initiated using pop-up advertising on infected websites or via cybersquatting of major websites. The victim is shown pop-ups which resemble legitimate error messages such as a Blue screen of death and freeze the victim's web browser. The pop-up instructs the victim to call the scammers via a phone number to "fix the error". Technical support scams can also be initiated via cold calls. These are usually robocalls which claim to be associated with a legitimate third party such as Apple Inc. Technical support scams can also attract victims by purchasing keyword advertising on major search engines for phrases such as "Microsoft support". Victims who click on these adverts are taken to web pages containing the scammer's phone numbers."Despite Crackdowns, Tech Support Ads In Search Are Still Cause For Consumer Confusion" . Search Engine Land, Ginny Marvin on August 5, 2014 In some cases, mass emailing is used. The email tends to state that a certain product has been purchased using their Amazon account and contact a certain telephone number if this is an error.
Confidence tricks Once a victim has contacted a scammer, the scammer will usually instruct them to download and install a remote access program such as TeamViewer, AnyDesk, LogMeIn, Supremo Control or GoToAssist. The scammer convinces the victim to provide them with the credentials required to initiate a remote-control session, giving the scammer complete control of the victim's desktop. The scammer will not tell the victim that he is using a remote control software and that the purpose is to gain access to the victim's PC. The scammer will say "this is for connecting you to our secure server" or "I am going to give you a secure code" which in reality is just an ID number used by the remote desktop software package.
After gaining access, the scammer attempts to convince the victim that the computer is suffering from problems that must be repaired. They will use several methods to misrepresent the content and significance of common Windows tools and system directories as evidence of malicious activity, such as viruses and other malware. These tricks are meant to target victims, often older people, who are unfamiliar with the actual meaning of the tools' displays of, for example multiple normal and trivial error messages (e.g., Error 8193: VSS). The scammer then coaxes the victim into paying for the scammer's services and/or software, which they claim is designed to "repair" or "clean" the computer but is either malicious or simply does nothing at all. The scammer may open Windows' Event Viewer, which displays a logfile of various events for use by system administrators to troubleshoot problems. Although many of the log entries are relatively harmless notifications, the scammer may claim that the log entries labeled as warnings and errors are evidence of "system corruption" that must be "fixed" for a fee. The scammer may show system folders that contain unusually named files to the victim, such as those in Windows' Prefetch and Temp folders, and claim that the files are evidence of malware on the victim's computer. The scammer may also open some of these files in Notepad, wherein binary file contents are rendered as mojibake. The scammer claims that malware has corrupted these files, causing the unintelligible output. In reality, the files in Prefetch are typically harmless, intact binary files used to speed up certain operations. The scammer may falsely claim that normally disabled Windows services should not be disabled and that these services were disabled due to a computer virus. The scammer may misuse Command Prompt tools to generate suspicious-looking output, for instance using the tree or dir /s command which displays an extensive listing of files and directories. The scammer may claim that they are "searching for malware and hackers", and while the tool is running the scammer will enter text purporting to be an error message (such as "ECHO security breach ... trojans found") that will appear when the job finishes, or will open a text file with such claims in Notepad or Word. The scammer may misrepresent innocuous values and keys that are stored in the Windows Registry as being signs of malware. The "Send To" Windows function is associated with a globally unique identifier. The output of the command assoc, which lists all file associations on the system, displays this association with the line ZFSendToTarget=CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}; this GUID is the same on all recent versions of Windows. The scammer may claim that this is a unique ID used to identify the user's computer, before reading out the identifier to "verify" that they are a legitimate support company with information on the victim's computer, or claim that the CLSID listed is actually a "Computer Licence Security ID" that must be renewed. The scammer may claim that the alleged "problems" are the result of expired hardware or software warranties and then coax the victim into paying for a nonsensical and fraudulent "renewal service". The scammer may block the victim from viewing their screen, claiming that it is the result of malware or of a scan being run, and use this time to search the victim's files for sensitive information, attempt to break into the victim's bank account with stolen or found credentials or activate the webcam and see the victim's face. The scammer may run the netstat command line tool, which shows local and foreign (meaning only not on the local computer) IP addresses. The scammer then tells the victim that these addresses belong to hackers in foreign countries that have gained access to their network. The scammer may claim that legitimate Windows process such as rundll32.exe are viruses. Often, the scammer will search Google or Yahoo for an article about RUNDLL32.EXE and will scroll to a section saying that the process name can also possibly be part of a malware infection, even though the victim's computer does not contain malware. More dangerously, the thief may persuade the victim to connect to online banking with password and two-factor authentication, watching and able to act, sometimes blanking the victim's screen, with the pretext of securing the bank account from hackers. The victim may be told that they are connected to a "secure server", with no human able to see what is done.
Payment and impact