After fake tech support, start with what they controlled or saw

Start with what the caller controlled, saw, installed, or charged. A fake virus warning by itself is not proof your device is infected. Remote access, payments, passwords, one-time codes, and exposed documents need faster action.

If more than one row applies, handle the highest-risk item first: remote access, money, passwords or codes, identity documents, then work or school systems.

If someone controlled your screen

Remote access changes the risk because the caller may have moved the mouse, watched sign-ins, opened windows, changed settings, installed tools, or viewed files. It can expose information, but it does not prove every file was copied.

Focus on what was actually open, unlocked, spoken aloud, or typed while the caller was connected:

• Banking, card, PayPal, payment app, crypto, shopping, or tax accounts.
• Email inboxes, password reset messages, security alerts, deleted mail, sent mail, and forwarding rules.
• Unlocked password managers, browser-saved passwords, app passwords, recovery email, recovery phone, and two-factor settings.
• Tax forms, IDs, Social Security numbers, account statements, private photos, and cloud files.
• Work or school email, VPNs, admin panels, shared drives, customer files, or internal systems.

If money was paid

Contact the payment provider first. The bank, card issuer, payment app, wire company, gift card issuer, PayPal, or crypto platform controls the charge, transfer, dispute, card replacement, account lock, or transaction review options.

• Credit or debit card: call the issuer using the number on the card or statement. Ask about disputes, card replacement, recurring charges, and account monitoring.
• Gift card: keep the card and receipt, then contact the gift card issuer quickly. Do not send photos of the card to anyone else.
• Wire, bank transfer, Zelle, or payment app: contact the bank or app through the official app or website and ask what can be stopped, reviewed, or documented.
• PayPal or invoice platform: open the official app or website yourself and report the transaction there.
• Crypto: save the wallet address, transaction hash, amount, date, and platform. Be cautious with anyone promising guaranteed recovery.

If the caller says you were refunded too much, pause. Do not send money back, buy gift cards, move money to a safe account, or transfer funds while the caller is still guiding you.

If account or personal information was visible

Treat anything open, unlocked, copied, photographed, typed, or spoken aloud as possible exposure. Start with the accounts or documents that could cause account takeover, payment loss, or identity misuse.

• Banking or card screens: contact the financial provider and review recent, pending, and scheduled activity.
• Email inbox: check recovery settings, forwarding rules, deleted messages, sent messages, recent sign-ins, and connected apps.
• Password manager or browser passwords: change accounts that were visible, autofilled, or unlocked, and review connected devices.
• SSN, tax forms, IDs, or identity documents: use IdentityTheft.gov if identity theft or misuse applies.
• Cloud files, photos, or backups: check account sessions, sharing settings, recent activity, and unfamiliar devices.

Verify support outside the warning, invoice, or call

Do not use the phone number, link, chat window, invoice, search ad, or remote session to prove the support offer is real. Open the company's official site or app yourself, or use a known phone number from a card, statement, device settings, product packaging, or official support page.

Be careful with brand names in the warning. Microsoft, Apple, banks, antivirus companies, internet providers, payment apps, and remote-access tools can all be impersonated. The verification path matters more than the logo on the message.

What not to do now

• Do not call the same number back, even if the caller sounded professional.
• Do not reconnect remote access for a refund, cancellation, cleanup, or security check.
• Do not pay a recovery service that promises to get money back.
• Do not share more one-time codes, passwords, card numbers, bank details, or screenshots.
• Do not use the suspicious pop-up, invoice, email, chat, or search ad to verify the company.
• Do not wipe the device before saving payment evidence if you need to report or dispute the fraud, unless trusted support tells you to.

Where to report or ask for help

Use the official path that matches what happened. Reporting is still useful even if money was not lost, but payment and account help should start with the provider that controls the account or transaction.

• FTC ReportFraud: consumer fraud, fake tech support, fake invoices, impersonation, and payment pressure.
• FBI IC3: internet-enabled crime or fraud, especially when remote access, wire transfers, crypto, or larger losses are involved.
• Bank, card issuer, payment app, wire company, gift card issuer, PayPal, or crypto platform: disputes, account locks, transaction review, card replacement, and records.
• Microsoft or Apple: account security or brand impersonation involving those accounts or devices.
• Remote-access provider: suspicious use of AnyDesk or another remote-access tool, if the provider offers an abuse or support channel.
• Work or school IT: any managed device, managed account, employer email, school login, VPN, or internal system.
• Local police or 911: threats, immediate danger, local theft, or someone trying to pick up cash, gold, cards, or devices in person.

FAQ

Is a fake virus pop-up proof my computer is infected?

No. A scary pop-up can be a web page designed to make you call. Close the browser or restart the device. If you downloaded something, installed software, or the warning returns outside the browser, check the device more closely.

Does Microsoft or Apple call about viruses?

Treat an unexpected call about a virus, hacked device, expired security software, or urgent account problem as suspicious. Use the official support page, device settings, app, or account portal instead of the number or chat in the warning.

What if I called but did not give access or pay?

End contact and do not call back. Review whether you shared a password, one-time code, payment detail, address, date of birth, or other private information. If you only talked and shared nothing sensitive, the main risk is follow-up pressure.

Should I reset the computer after a tech support scam?

Not always. Start by disconnecting remote access, removing the tool, scanning with trusted security software, and reviewing what changed. A reset may be appropriate if unknown software remains, access keeps returning, or trusted support recommends it.

What if the scammer saw my bank account?

Contact the bank using the official app, website, statement number, or card number. Tell them a scammer viewed the account during a remote-access session and ask what should be monitored, blocked, replaced, or documented.

Can I get money back after paying fake tech support?

It depends on the payment method, timing, and provider rules. Cards and some platforms may have dispute or replacement options. Gift cards, wires, payment apps, Zelle, and crypto can be harder. Do not pay anyone who promises guaranteed recovery.