How can you spot a PC support scam attempt? Here are a few clues to help you:
Number 1: They called you, you did not call them:
This is the biggest tip-off of the scam. Microsoft, Dell, or any other major company's tech support organization is not likely going to waste their resources to call you. If you have tech support problems, they know that you will call them. They are not going to go looking for trouble. The scammers will tell you that they are doing this is a "public service". Don't buy into this, it's a complete lie.
Number 2: The Caller ID Says Microsoft, Tech Support, or something similar and appears to originate from a legitimate phone number. This is another key part of the scam. What's the first thing you check when the phone rings? The caller ID information, of course. This information is what helps the scammer establish legitimacy. Your brain tells you that the caller ID info validates the claims of the caller so they must be for real, right? Wrong. The scammers are trying to build a pretext for their scam. If someone was trying to scam you in person, they would wear a tech support badge. Spoofed caller ID information is just like putting on a fake badge, it looks legitimate, so many people believe it.
Spoofing Caller ID info is extremely easy via voice over IP technology, Check out my next article on Caller ID Spoofing for full details on how the process works.
Number 3: They have a thick foreign accent but use a name that is usually of western origin. This is one of the funniest parts of the scam for me. The scammer will usually have an extremely thick foreign accent, but will claim that their name is something decidedly western such as "Brad". If I tell them that they don't sound like a "Brad" then they will usually counter with something like "my name is so hard to pronounce that I use Brad instead to make things easier for people".
Number 4: They claim that your computer is "sending off errors", or "sending out spam", "infected with a new virus that is undetectable by current scanners", or something else similar.
Nobody wants to cause problems for others or get in trouble for having a computer that is doing bad things, and no one wants a virus. This part of the scam scares the user into wanting to have the scammer take action. Their purpose is to create fear in your mind that your computer is infected and is trying to do bad things to other computers.
Number 5: They ask you to open the windows event log viewer to "show you the problem". The scammers want you to think that they are knowledgeable and that there is a problem by 'showing you' that your system has 'errors'. They do this by having you open the Windows Event Log Viewer so that they can attempt to prove their case. News flash: there is almost always going to be some kind of minor error or warning in the event log viewer, This doesn't mean that your system is having any real problems or is infected by anything.
Number 6: They ask you to go to a website and install a tool so that they can remotely connect to your computer to 'fix' the problem. This is the part where the scam gets dangerous. The scammers want to take control of your computer, but not for the purpose of fixing it as they claim. The scammers want to infect your computer with malware, rootkits, keyloggers, etc. In order for them to do so, they need a way in. There are several free remote connection software packages that are completely legitimate tools designed for remote tech support. Some of the more popular ones used by the scammers include Ammyy, TeamViewer, LogMeIn Rescue, and GoToMyPC, The scammers will ask you to install one of these tools and provide them with an ID number, or some other credential generated by the remote connection tool, They will then use this information to gain access to your computer., At this point your computer has been compromised.
The quickest way to get these idiots off the phone is to tell them that you don't have a computer at all. As with any scam, there will be new variants as the scam is refined, so be on the lookout for new tactics, but the basic clues above will probably remain unchanged.
As always, stay safe!
- Bird
***
