Tech Support Scam Fake Warnings: Response and Rules for SMBs

When a fake virus warning appears, there are two things to do: do not call the phone number shown on the screen, and close the browser (force-quit it if it will not close). If someone has already called and allowed remote access, disconnect the PC from the network at once and report it to the person in charge inside the company. Tech support scams, which use fake virus or security warnings to make people call a number, install remote-access software, or pay with gift cards and e-money, also happen on business PCs, not just personal ones. The screens look convincing and may play alarm sounds or voice messages, so it is not surprising that an employee in a hurry makes the call. This article organizes, in terms a non-IT manager can act on, how the scam works, what to do when the screen appears, what to do first after a victim has acted, issues specific to business PCs, and the rules a company should prepare. For the overall flow of an IT emergency such as suspected infection or fraudulent transfers, see also the first-response guide for IT emergencies.

A tech support scam displays a fake warning on a PC or smartphone, such as "your computer is infected" or "your personal information is leaking," and makes the user call the support number on the screen. The person who answers poses as a support agent from a well-known company, stokes anxiety, and instructs the caller to install remote-access software. Money is then demanded under names such as "removal fee" or "support contract." The IPA (Information-technology Promotion Agency, Japan) and Japan's National Police Agency continue to issue warnings about this technique.

What stands out is that the entry point is not a phone call but the screen of the browser people use every day. While an employee is searching for something during work, a search ad, an ad slot on a site being viewed, or a suspicious link leads them to a fake warning page. Conventional anti-phishing measures, such as being suspicious of email text, are therefore not enough.

Fake warning screens share several features. The actual wording changes constantly, so remembering the structure, in which the screen pushes you to call a number, is more useful than memorizing specific phrases.

- Full-screen display: The browser goes full screen and the close button and address bar disappear. Some pages try to look as if they do not respond to the mouse.
- Alarm sounds or voice: A repeated beep or a synthesized voice announces an infection.
- Names of famous companies: The page uses the logos and names of Microsoft, Apple, and others, with labels like "Windows Security" or "System Alert" to look genuine.
- A prominent phone number: A number that looks like a toll-free line is displayed in a conspicuous spot with text such as "Contact support immediately."
- Alarming wording: Messages such as "This computer has been locked," "Your online banking information has been stolen," or "All data will be lost if you ignore this."
- The warning returns: Even after you quit the browser, restoring the previous pages on restart can bring back the same warning.

A genuine antivirus program or operating system warning almost never tells you to call a specific phone number. If you remember that "a screen that demands a phone call is fake," you can identify most of these.

Once the victim calls, the other party speaks politely, says they will check the situation, and asks the victim to install remote-access software. When the screen becomes visible to them, they pretend to operate on the victim's behalf while having the victim open online banking, browsing files on the PC, or installing other malicious software. Payment is often demanded by having the victim read out gift card numbers, buy e-money at a convenience store, or transfer money through online banking.

At the moment the screen appears, no harm has yet occurred. Staying calm and following the steps below is enough.

1. Do not call. Do not dial the number on the screen. Talking to the self-described support agent is where the manipulation begins.
2. Do not click anything on the screen. That includes buttons such as "Close," "OK," "Cancel," and "Start scan."
3. Close the browser. If it can be closed, close the tab or window as usual.
4. If it cannot be closed, force-quit it. In full-screen mode, holding the Esc key for a few seconds may release full screen. If that fails, on Windows press Ctrl + Alt + Delete, open Task Manager, and end the browser. On a Mac, press Command + Option + Esc, choose the browser in the Force Quit window, and quit it. If nothing works, holding the power button to turn the machine off is acceptable.
5. Do not restore the previous pages after restarting. If the browser offers to restore pages when you reopen it, do not choose that.
6. Check that nothing was entered or downloaded. If you downloaded or ran a file as the screen instructed, proceed to the next section.
7. Tell the person in charge. Even without any damage, briefly report when and how it happened, because other employees may see the same ad.

If possible, a screenshot of the warning is useful for later consultation. However, do not struggle to take one and end up interacting with the screen. If you granted a browser notification permission when asked, remove that site's notification permission in the browser settings.

Even when someone has called, installed remote-access software, or paid, how you act afterward can limit the damage. Delayed reporting out of embarrassment spreads damage the most, so a company should decide in advance that it will not blame the person who reports.

1. Disconnect from the network. Unplug the LAN cable and turn off Wi-Fi to physically stop the remote session. The basic approach is to disconnect but not power off, so that the state can be preserved for investigation. If operation is still continuing and dangerous, powering off is acceptable.
2. Hang up and do not call back. Do not answer if the other party calls again.
3. Report to the person in charge. If the PC could access client or customer data, say so as well.
4. Check for and remove remote-access software. Check whether software installed at their instruction is present (names such as AnyDesk, TeamViewer, and Quick Assist are often used) and uninstall it. Treat any other unfamiliar software the same way. However, do not keep operating a PC suspected of infection on your own judgment; having an expert initialize or investigate it is recommended.
5. Change passwords. From a separate, safe device, change the passwords that were typed or saved on that PC (email, cloud services, business systems, and passwords stored in the browser). Enable multi-factor authentication wherever possible.
6. Check online banking and other services. Look for transactions, transfers, or logins you do not recognize. If anything looks suspicious, contact the financial institution immediately and ask about suspending transactions.
7. If you paid, contact the card company, financial institution, or issuer. If you gave a credit card number, ask the card company to suspend and reissue it. If you used gift cards or e-money, contact the issuer's support quickly. A refund is not guaranteed, but the earlier you act, the more room remains.
8. Consult a support desk. Consult the police consultation line #9110 or the cybercrime consultation desk of your prefectural police. If money was lost, consider filing a damage report. For how to handle infection or remote access, you can also consult the IPA's information security consultation desk (phone 03-5978-7509).

It cannot be ruled out that files on the PC were sent out during the remote session or that other malicious software was planted. Even if nothing looks wrong, treat that PC as "not safe to assume clean," and consider initializing it and, if needed, an investigation by a specialist. For how to act when an incident could develop into ransomware or similar damage, the ransomware first-response article is also useful.

Damage on a personal PC generally stays within the individual's financial loss. On a business PC, the company's information assets are affected.

- Possible leakage of client and customer data: During a remote session, the other party can view files, email, and information saved in the browser on the PC. First take stock of what information was on that PC.
- Unauthorized login to business systems: Passwords saved in the browser and logged-in sessions can be abused. Change the passwords of cloud services and groupware, and check login history.
- Impact on other devices on the same network: Damage may reach shared folders and other PCs on the same network. An investigation after disconnection is needed.
- Reporting under Japan's Act on the Protection of Personal Information: If personal data has been leaked or may have been leaked, and conditions apply, such as sensitive personal information being included, a risk of financial harm, a leak with a malicious purpose, or more than 1,000 individuals, a report to the Personal Information Protection Commission and notification to the individuals are mandatory. Remote access caused by a tech support scam can amount to a possible leak by unauthorized acts, so whenever remote access was allowed on a PC handling personal information, always check whether a report is required. Deadlines and formats are published on the Commission's website; in an actual case, check the latest information and consult an expert as needed.
- Notifying business partners: If a partner's information may have leaked, also check whether the contract imposes a duty to notify.

The internal reporting route should also be decided. In a small company, a simple form is enough: contact your direct supervisor or the general affairs staff first, and consult outside experts if necessary. What matters is that one person is reachable even at night and on holidays, and that their contact details are known to all employees.

Tech support scams cannot be stopped by technical measures alone or by education alone. It helps to think in three layers: make the screens appear less often, make harm less likely when they do, and be able to act when they appear. Below are the main measures and rough costs. Costs vary greatly by company size, number of devices, and contract type, so treat them only as a guide.

The measures with the best cost-effectiveness are actually the free ones. Removing administrator rights alone can prevent remote-access software from being installed at an employee's discretion in many cases. If installation is needed for work, set up an operation in which employees apply and an administrator installs it. For browser notifications, review the notification permissions granted to unneeded sites in bulk. EDR has become easier to adopt, but it should be considered in light of the number of devices and the operational burden. Costs and selection are covered in more detail in the cost of EDR and endpoint security.

On the education side, having seen an actual example of such a screen makes a big difference. Once a year, even for a few dozen minutes, show real examples of fake warnings and confirm the response steps. For how to run it and how to think about cost, see the cost of security awareness training.

Putting the following on one sheet and posting it near the PCs or on the intranet prevents hesitation when it matters. The trick is to avoid jargon and write only the actions.

- Do not call. The number on the screen is not real support.
- Do not click anything on the screen. Do not press "Close" or "OK" either.
- Close the browser. If it will not close, hold Esc, or force-quit with Ctrl + Alt + Delete (Command + Option + Esc on a Mac).
- Do not install software the screen tells you to. Do not download or run anything either.
- If you already called or installed something, unplug the LAN cable (or turn off Wi-Fi).
- Contact XX (name, extension, mobile number) right away. Do not be embarrassed; the sooner you tell us, the smaller the damage.
- Nobody is blamed for reporting. Reporting itself is valued.

Even a company without a dedicated IT person can check the following on the judgment of the owner or general affairs. Items you cannot answer "yes" to are where to start.

- Are employees unable to install software on their own judgment?
- Are browser notification permissions left granted to unneeded sites?
- Is security software installed and updated on all devices?
- Does everyone know the "what to do when the screen appears" rule?
- Are the contacts for suspected damage (the person in charge and external consultation desks) decided and known?
- Is the policy of not blaming employees who report, and encouraging reports, shared?
- Do you know which PCs handle personal information?
- Have you checked, at least once, the cases where a report to the Personal Information Protection Commission could be required?
- Is client and customer data not concentrated on particular PCs?
- Is there a chance once a year to review and communicate the procedure?