It arrives the same way every time. Your screen fills with a warning in Microsoft or Apple colours, an alarm noise starts, and a phone number appears with instructions to call immediately. Sometimes it shows your real IP address or browser name to look convincing.
The one rule that settles it
A genuine Microsoft or Apple error message never contains a phone number. Not ever. If there is a number on the screen, the screen is lying to you. Neither company will contact you unprompted about a problem with your computer either.
What to do right now
- Do not call the number. That is the entire attack. Everything else is theatre designed to get you to dial.
- Close the tab. If the page has blocked normal closing, force the browser to quit: Ctrl+Shift+Esc on Windows and end the browser task, or Cmd+Option+Esc on a Mac and force quit it.
- Reopen the browser and decline to restore tabs. Restoring brings the scam page straight back.
- Clear the browser cache so the page cannot reappear from history.
If you already called
This is the part that matters, and it is not hopeless. Work through it in order:
- If you let them connect to your computer, disconnect it from the internet now. They almost always install a remote access tool — TeamViewer, AnyDesk, LogMeIn — and it will still be there after they hang up. Assume the machine needs a proper clean, not a reboot.
- If you paid, call your bank or card issuer straight away and tell them it was a tech support scam. Card payments can often be reversed. If they asked for gift cards, a bank transfer or cryptocurrency, that was because those are hard to reverse — report it anyway, immediately.
- If you typed any password while they watched, change it from a different device, and change it anywhere else you used the same one.
- Turn on two-factor authentication for your email first. Email is the master key to everything else.
Why it is convincing
These pages are ordinary websites. They cannot scan your computer, they have not detected a virus, and they know nothing about you beyond what any website can see. The IP address and browser name they display are visible to every site you visit. The alarm sound and the countdown exist to stop you thinking clearly enough to notice that.
The people who answer the phone are practised. They sound calm and technical, they will show you ordinary Windows screens and describe them as evidence of infection, and they will be patient. None of it means anything.
If any of this is beyond where you want to go on your own, a Koadi technician can take it from here — remotely anywhere in the US, or on-site in New Jersey, New York and Pennsylvania. Describe the problem in your own words and someone who does this every day will pick it up.