{
  "slug": "microsoft-tech-support-popup",
  "canonical_name": "\"Your computer is infected, call Microsoft / Apple\" page",
  "family": "tech-support-popup",
  "impersonates": {
    "brand": "Microsoft / Apple",
    "disclaimer": "Microsoft / Apple is not involved; criminals impersonate the brand.",
    "official_fraud_page": "https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435"
  },
  "goal": [
    "callback",
    "remote-access",
    "payment"
  ],
  "channels": [
    "web",
    "call",
    "email"
  ],
  "summary": "A full-screen browser page with alarms and a phone number, styled as Microsoft or Apple support. The page cannot see your computer; the number leads to a remote-access session and a sale or a \"refund\" that turns into a transfer.",
  "status": "active",
  "first_seen": null,
  "last_seen": null,
  "recognise": [
    "Alarms, countdowns and a toll-free number on a web page",
    "The page will not close normally",
    "Microsoft and Apple never put phone numbers in security warnings"
  ],
  "variants": [],
  "specimen": null,
  "tells": [],
  "indicators": {
    "sender_domains": [],
    "senders": [],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not call; close the browser (Task Manager or Force Quit if needed)",
      "If you want reassurance, run your own antivirus"
    ],
    "if_called_or_paid": [
      "Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device",
      "Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers",
      "Expect a call-back from a \"refund department\" — that is act two of the same scam. Hang up"
    ],
    "report_links": [
      {
        "label": "Microsoft: protect yourself from tech support scams",
        "url": "https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435"
      },
      {
        "label": "Apple: recognise and avoid social-engineering schemes",
        "url": "https://support.apple.com/en-us/102568"
      },
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Opened at launch from the pattern Microsoft and Apple document; no dated specimen on record yet — send yours.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "zeus-virus-detected-alert",
    "geek-squad-renewal-invoice"
  ],
  "sources": [
    "https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435",
    "https://support.apple.com/en-us/102568"
  ],
  "legacy_urls": [],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/microsoft-tech-support-popup",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}