Browse Definitions :
Definition

tech support phone scam

A tech support phone scam is an exploit in which an attacker calls offering assistance with  problems they claim were detected on the victim's computer.

Here’s how a typical tech support phone scam works:

The attacker calls using a virtual phone number that appears to be from the target’s area code, to increase the likelihood that someone will pick up. When the target answers the phone, the attacker says they’re calling from some well-known company, such as Microsoft, and that the user’s ISP has detected malware on their computer, which the caller offers to get rid of.

In the next step, the caller asks the victim to download some legitimate remote control software, such as TeamViewer, pcAnywhere or GoToMyPC. The caller takes control of the victim's computer and he or an accomplice communicates with them through the phone or on chat. 

As the victim watches, the caller displays Event Viewer, which always displays errors or warnings for relatively innocuous events. The caller says this is evidence of malware on the system and offers to get rid of it, once the victim has paid the fees. The caller may ask for credit card information or request payment through some online service like Paypal. 

In the best-case scenario, once the attacker has collected the fees he does nothing to the computer. However, because he has administrative access to the victim's computer, he can install malware or access sensitive information that can be used for identity theft. 

The best way to protect yourself from such scams is to be highly suspicious of unsolicited calls from unknown sources and never give unauthorized strangers access to your computer. 

See a video of what happened when tech support scammers unknowingly called a security researcher: 

This was last updated in September 2013

Continue Reading About tech support phone scam

SearchCompliance
  • OPSEC (operations security)

    OPSEC (operations security) is a security and risk management process and strategy that classifies information, then determines ...

  • smart contract

    A smart contract is a decentralized application that executes business logic in response to events.

  • compliance risk

    Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting ...

SearchSecurity
  • threat modeling

    Threat modeling is a procedure for optimizing application, system or business process security by identifying objectives and ...

  • distributed denial-of-service (DDoS) attack

    A distributed denial-of-service (DDoS) attack is one in which multiple compromised computer systems attack a target, such as a ...

  • social engineering

    Social engineering is an attack vector that relies heavily on human interaction and often involves manipulating people into ...

SearchHealthIT
SearchDisasterRecovery
  • change control

    Change control is a systematic approach to managing all changes made to a product or system.

  • disaster recovery (DR)

    Disaster recovery (DR) is an organization's ability to respond to and recover from an event that affects business operations.

  • risk mitigation

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

SearchStorage
  • bare-metal cloud

    Bare-metal cloud is a public cloud service that offers dedicated hardware resources without any installed operating systems or ...

  • race condition

    A race condition is an undesirable situation that occurs when a device or system attempts to perform two or more operations at ...

  • storage security

    Storage security is the group of parameters and settings that make storage resources available to authorized users and trusted ...

Close