Customer Support and IT Scams

Common scenario

A front-desk employee sees a browser warning claiming a work device has a serious issue. The warning gives a support number. Later, someone claiming to help asks the employee to start a remote support session and keep the screen open.

Warning signs

• A popup, call, email, text, or ad claims there is an urgent device, account, or software problem.
• The message tells staff to call a number shown on the warning screen or search result.
• The person asks to install software, approve a login, or allow remote access.
• The request asks for a one-time code, password, recovery prompt, or screen sharing.
• The caller pressures the employee not to restart, not to ask a manager, or not to disconnect.
• The support contact was not started through the business's normal provider portal or known channel.
• A software renewal or account warning arrives outside the normal billing or support process.

Questions to ask

• Did we start this support request through a known provider channel?
• Is someone asking for remote access, screen sharing, software installation, or login approval?
• Is the contact information coming from a popup, search ad, or surprise message?
• Can the task wait until an approved internal person reviews it?
• Does the request involve one-time codes, passwords, recovery prompts, or payment?
• Do we have a normal support provider, device manager, or owner who should handle this?

Verification workflow

• Stop interacting with the popup, caller, or message and do not share codes or access.
• Tell the approved internal contact, owner, or technology support person what appeared.
• Use only known support channels already saved by the business.
• Do not install software or approve remote access unless the support session was started through an approved process.
• Write down the general time, channel, and visible warning without adding private account details.
• Review whether any login, access, or payment action was taken before continuing normal work.
• Use the business's normal device and account process to decide what happens next.

Example internal policy

• Staff may not grant remote access from a surprise call, popup, text, or email.
• Support sessions must be started through an approved provider or known internal contact.
• One-time codes, passwords, and recovery prompts are never shared through support chats or calls.
• Employees should close or pause suspicious support requests and ask for help without blame.
• Search result ads and popup phone numbers are not treated as official support channels.

What not to do

• Do not call a phone number shown in a scary popup.
• Do not install remote-access tools from a surprise support request.
• Do not share one-time codes, passwords, recovery prompts, or login approvals.
• Do not keep talking because the caller sounds technical or confident.
• Do not enter payment information to fix a sudden warning.
• Do not confront the caller or try to trick them.
• Do not continue using an affected device for sensitive tasks until the business's normal review is complete.

If something already happened

• Disconnect from the support interaction and notify the owner or approved technology contact.
• Record the time, channel, and general action taken.
• List any business systems that may have been viewed or accessed without adding private details to shared notes.
• Follow the business's normal device, account, and provider review process.
• Tell nearby staff not to respond to similar calls, popups, or messages.
• Review whether staff need a clearer remote-access rule or desk reminder.