This is what a Microsoft tech support scam looks like

Con artists will use many tricks to steal your money, including contacting you via a fake IT support call.

While the Microsoft tech support scam is nothing new, South Africans still reportedly receive calls from “agents” claiming to be from the company.

The scam usually involves convincing you that they have detected a problem with your computer, and then take you through steps that give them remote access to your machine.

Once they’ve got control of your machine, the scammers use a number of tactics to get money out of you.

This includes infecting your machine with malware that gathers data like usernames and passwords.

What a tech support scam looks like

A number of YouTubers have set up virtual machines and taken these con artists for a ride.

YouTuber Eric Henn decided to have some fun and see if he could get a technician to open files that were not intended for his eyes – as shown below.


The virtual machine is set up to look as though it is infected with malware.

The desktop also contains a folder called “Naked girlfriend” and a spreadsheet called “banking and checking account”

Scammers will go to any lengths to trick you out of your hard-earned cash, including impersonating a well-meaning tech support agent.


One version of the scam tries to trick you into calling an “agent”. Alternatively, they cold call you.

Tech support scam invasive ad


They ask you to open a run dialog and open the Windows Help browser.

Tech support scam run command


You are asked to use the “jump to URL” feature to navigate to the website of remote desktop software.

Tech support scam Help Browser jump to URL


In this case, Citrix GotoAssist is used.

Tech support scam GoToAssist login page


Windows prompts you to install the software.

Tech support scam Citrix GotoAssist installer prompt


Every time the “tech support agent” tells you to click in the affirmative.

Tech support scam Citrix GotoAssist starts up


Installing the remote desktop software will also trigger a UAC prompt on Windows Vista and later.

Tech support scam Citrix GotoAssist UAC prompt


Once installed, Citrix prompts you to accept the remote desktop connection.

Tech support scam GoToAssist confirm remote take-over


Once in your machine, the con artist will run utilities to try and convince you there is something wrong with your computer.

Tech support scam msconfig


To try and convince the user something is wrong, the scammer runs the “tree” command.

Tech support scam tree command


While “tree” is running, they paste a scary-looking string that will appear on the command line when it has finished executing.

Tech support scam tree command end with csrss warning


The “agent” also shows you a webpage that tells you just how bad your PC’s problem is.

Tech support scam csrss.exe virus warning


With fear instilled in you, the sales pitch begins.

Tech support scam - The sales pitch


To the scammer’s credit, in this case, they did open the spreadsheet or the folder of “naked pics”, so Eric Henn did it for them.

Tech support scam RickRolld


Watch Eric Henn’s full video below


Beware of fake IT callers in SA who can empty your bank account

Beware fake Microsoft support scams in SA

Latest news

Partner Content

Show comments

Recommended

Share this article
This is what a Microsoft tech support scam looks like