Overview
The victim expects to have some technical support problem solved, such as installing software or having viruses, malware, or supposedly illegal material removed from a computer.
How It Works
The victim is lured into the scam by passively running into a popup ad or other notice claiming that they are infected with a virus, or something is wrong with the computer and they should call a phone number.
The phone number is answered by one or more scammers impersonating a technical support organization.
They say that they've detected viruses or other malware on the victim's computer. This is part of a ruse to trick the victim into paying for unnecessary software (often that doesn't exist or is malware) or to convince the victim to give the fraudsters remote access to the computer.
If remote access is given, the fraudsters can exfiltrate cryptocurrency or banking data, or launch an overpayment scam.
The call to action is nearly always calling a phone number since the scam is fairly complicated and the scammer needs to interact with the victim to accomplish the install of the remote access software and ultimately the exfiltration of data.
This scam is sometimes compared to a modern day variant of the classic fortune telling scam, in which the scammer promises to remove hexes or curses from a victim, for a fee.
Related Articles
Listed as a "top 10 scam of 2025" by Vermont Attorney General, VermontBiz January 12, 2026
Related Scams
See also 2.2.2 Fake Invoice Reversal Scam
Related Crime Schemes
A particular instance of this scam may embed one or more of these related schemes.
Data Loss or Theft: Any scheme that results in victim losing data/scammer stealing data. Data in this context can mean login credentials, credit card details, or other personal or corporate information.
Extortion: Extortion refers to any scheme that uses a threat of additional damage to extract payment from the victim.
Overpayment scheme: In an overpayment scheme, victims are told they have been given a large amount of money as part of the scam and are asked to refund a smaller amount back to the scammer. In reality, the initial overpayment does not exist.
Victim Targeting Context
The scammer may use one or more of the following techniques to reach the victim.
Advertising: The scammer uses advertising to passively reach the victim.
Spray and Pray / Scattered: The scammer approaches many victims at once such as through bulk email or SMS.
Social Engineering: Psychological Manipulations
The scammer may use one or more of these psychological techniques to accomplish the scam.
Abuse of authority position: The scammer employs an abuse of a position of authority to convince the victim to go along with the scam.
Codes or Jargon: The scammer uses official-looking codes or technical jargon as part of the scam to increase appearance of legitimacy or to confuse the victim.
Complexity: The scammer has a complicated story to explain the scam, or leverages scientific/economic complexity in order to confuse the victim.
Threats/Fear/Extortion/Blackmail: The scammer employs threats to increase fear in the victim so that they will go along with the scam. Threats can include financial loss, legal action, arrest, account closure, extortion, blackmail.
Urgency: The scammer employs urgency to increase the likelihood that the victim will take action.
Social Engineering: Impersonation Techniques
The scammer may impersonate one or more of the following groups as part of the scam.
Business or NonProfit: The scammer impersonates a business or nonprofit.
Technical Support / Tech: The scammer impersonates a technical support worker or tech company.