Lesson 6 of 7

Fake virus alerts and tech-support scams

Some of the most common online scams imitate security software. Knowing how genuine security messages behave makes the fakes much easier to recognise. This lesson describes the patterns in general terms and points you to the organisations that handle reports in New Zealand.

Why scams imitate security software

A scam works by getting a person to act before they think. Security warnings are a useful disguise for that, because most of us have learned to take them seriously. A message that looks like it comes from a trusted company and says something is wrong creates exactly the kind of pressure a scammer wants.

Knowing this is protective in itself. Once you know that security warnings are a favourite disguise, the next one that seems unusually dramatic is easier to approach calmly.

How genuine security messages usually behave

Genuine security tools tend to share a few habits. They are not a guarantee, but they give you a useful comparison.

They appear inside the product or the system: A real alert from Windows Security, macOS, or an installed antivirus product appears as a notification from that product, or inside its own window. It does not appear as a web page.
They do not ask you to phone a number: Security products may offer a support link, but they do not normally put a phone number in an alert and tell you to call it urgently.
They do not ask for payment to remove a threat you have just been told about: If you already have a working product, it deals with what it finds as part of what you have. A sudden demand for payment is a warning sign.
They can be checked independently: You can always close the message, open the security app yourself from the Start menu or Applications folder, and see whether it reports the same thing.

Pop-ups in the web browser

The most common fake is a web page that fills the screen, sometimes with alarming sounds, claiming that your computer has been scanned and found to be infected. A website cannot scan the files on your computer simply because you visited it. What it can do is display a picture that looks like a scan.

What to do if one appears

Do not call any number shown, and do not click buttons on the page.
Close the browser tab. If the page will not let you, close the whole browser. On Windows you can press Ctrl, Shift and Esc together to open Task Manager and end the browser there. On a Mac, press Command, Option and Esc and choose Force Quit.
When you reopen the browser, do not restore the previous session if asked.
If you want reassurance, open your security app yourself and check its status.

If you did not call or install anything, closing the page is usually the end of it. These pages are frightening, but on their own they are just web pages.

Phone calls from "technical support"

A related scam starts with a phone call. The caller says they are from a well-known technology company, your internet provider, or a security service, and that they have detected a problem with your computer. They then ask you to install a program so they can "fix" it. That program gives them remote control of the computer.

Large technology companies do not usually ring people out of the blue about problems on their computers. If you receive a call like this, you can simply hang up. If you are unsure, contact the company yourself using details from its official website, not a number the caller gives you.

Scam text messages and fake sign-in pages

Many scams now arrive as text messages rather than pop-ups. A message might say a parcel is waiting, a toll is unpaid, or an account has been locked, and include a link. The link leads to a page that looks like a real company's sign-in or payment page. Anything you type there goes to the scammer.

Some security products and browsers try to warn you about known fake pages, but new ones appear constantly, so a warning cannot be relied on. The safer habit is to avoid signing in through links in unexpected messages altogether. Instead, open the company's app, or type its address yourself, and check your account there. If there really is a problem, you will see it.

Two-step verification also helps here. If a scammer obtains your password, a second step, such as a code from an app, can stop them signing in. Never read that code out to anyone who contacts you, however convincing they sound; genuine companies do not ask for it.

Warning signs, gathered in one place

Signs that a security message may not be genuine

It appears in a web browser rather than in your security app.
It tells you to phone a number, often urgently.
It asks for payment by gift card, cryptocurrency or bank transfer.
It asks you to install remote-access software or read out a code sent to your phone.
It says you must not close the window or turn off the computer.
It arrived by unexpected call, text or email, rather than from software you installed.

Not every scam shows all of these, and a scam can change its details. The underlying pattern stays fairly constant, though: urgency, a request for contact or payment, and a reason not to stop and check.

If you have already called or installed something

This happens to careful people. Scammers are practised and persuasive, and there is no reason for embarrassment. What matters is acting calmly on the steps below.

Disconnect the computer from the internet if someone may still have remote access. Turn off Wi-Fi or unplug the network cable.
Contact your bank straight away if you made a payment or shared card or banking details. Use the number on the bank's website or the back of your card.
Remove any program the caller asked you to install. Lesson five explains how to uninstall software properly.
Change passwords for email and banking, using a different device if you can. Turn on two-step verification where it is offered.
Run a check with your security software, opened yourself from the Start menu or Applications folder.
Report what happened to one of the organisations below. Reports help them warn others.

Where to report and get help in New Zealand

Netsafe is an independent, not-for-profit online safety organisation. It offers help with online scams and harm, and its website explains how to contact it.
The National Cyber Security Centre takes reports of cyber security incidents, including scams and compromised accounts. Its household advice is on Own Your Online.
Consumer Protection publishes information about scams and your rights when buying, as part of the Ministry of Business, Innovation and Employment.

If you are in immediate danger or are being threatened, call 111.

Helping someone else stay alert

If you look after a less confident user, the most effective step is often a short, kind conversation rather than another piece of software. Agree together that any message asking for money, codes or remote access gets a pause and a phone call to you, or to someone they trust, before they act. Write the steps from the callout above on a card and keep it near the computer. Simple, practised responses work better in a stressful moment than anything that has to be remembered from scratch.