The phone rings and the caller says they are from Microsoft or Apple. They claim a virus has been detected, a license has expired, or an account is about to be locked. They ask you to download a tool or grant screen-sharing permission so they can “fix” the problem. Once remote access is active, the scammer can see the screen, control the mouse, and often capture passwords or install additional software.
These calls remain common because they exploit trust in well-known brands and create urgency. The immediate goal is to end the remote session cleanly and then verify that no persistent access remains. The steps below work for both Windows and Mac computers and cover the phone-based variants that target Apple or Google accounts. Acting methodically reduces the chance of leftover tools or compromised credentials.
Ending the Call and the Remote Session
Hang up without following further instructions
Once you recognize the call as fraudulent, end it. Do not continue the conversation to argue or to ask for a reference number. Scammers use extra time to apply more pressure or to complete installation of remote tools. A simple hang-up is sufficient.
Disconnect the computer from the internet immediately
Turn off Wi-Fi or unplug the Ethernet cable. Cutting the network connection prevents the remote-access software from communicating with the scammer’s server and stops further commands from being received. You can reconnect after the local checks are finished.
Close any remote-access or screen-sharing windows
Look for windows belonging to tools such as Quick Assist, TeamViewer, AnyDesk, or similar programs. Close them. On Windows, check the system tray for related icons and exit those processes. On a Mac, check the menu bar and Force Quit any unfamiliar sharing applications.
Do not restart yet if a remote tool is still visible
Restarting can sometimes allow a partially installed tool to finish configuration. First close the visible programs and disconnect from the network. A restart becomes useful later, after the obvious remote-access software has been removed.
Removing Remote-Access Software and Leftover Tools
Uninstall any programs you did not intentionally add
On Windows, open Settings > Apps and uninstall unfamiliar remote-access or support tools. On a Mac, check the Applications folder and remove anything unrecognized that appeared around the time of the call. Restart the computer after uninstalling so that residual processes stop.
Check for browser extensions or unexpected startup items
Some scammers add browser extensions or set programs to launch at startup. Review the browser’s extension list and the system’s startup or login items. Remove entries you do not recognize. This step catches persistence mechanisms that survive a simple uninstall.
Run a full scan with the built-in security tool
On Windows, use Windows Security for a full scan. On a Mac, use the built-in malware protections and consider a secondary reputable scanner if the incident involved a downloaded file. Note any detections and remove the flagged items according to the tool’s recommendations.
Review recent downloads and delete suspicious files
Open the Downloads folder and sort by date. Delete any installers or documents that arrived during or just before the call. Do not open them. Removing the original payload reduces the chance of accidental re-execution later.
Securing Accounts That May Have Been Exposed
Change passwords for email and any accounts used during the session
If you typed passwords or allowed the scammer to observe logins, change those passwords from a different device if possible. Start with the primary email, then move to banking, shopping, and Apple or Microsoft accounts. Enable or confirm multi-factor authentication on each.
Check Apple ID or Microsoft account for unfamiliar devices
Sign into account.microsoft.com or appleid.apple.com and review the list of devices and recent sessions. Remove any device or session you do not recognize. This step ends remote access that may have been granted at the account level rather than through local software.
Review banking and payment accounts for new activity
Log into each financial account and examine recent transactions, payees, and linked devices. Report anything unexpected immediately. A remote-access session is sometimes used to initiate transfers or to capture enough information for later fraud.
Revoke app passwords or third-party access if present
Some accounts allow app-specific passwords or connected third-party applications. Review those lists and revoke any entries that are unfamiliar or that were created during the incident window. Cleaning these permissions closes additional paths the attacker may have prepared.
Checking Phones If the Call Targeted Mobile Devices
Refuse any request to install support profiles or apps
On iPhone or Android, legitimate Apple or Google support does not cold-call and demand the installation of configuration profiles or remote-support apps. If a profile was already installed, remove it in Settings and restart the device. Uninstall any support apps that appeared during the call.
Change the Apple ID or Google account password
If credentials were shared or observed, change the account password and review devices signed into the account. Remove unfamiliar devices and confirm that recovery methods are still under your control. Securing the account protects Find My, backups, and linked services.
Check for unexpected screen-sharing or remote-management settings
Both platforms have accessibility and remote-management features that can be misused. Review those settings and disable anything you did not intentionally enable. A quick pass through accessibility and device-admin menus catches many leftover permissions.
Run the platform’s built-in security checks
On Android, use Google Play Protect. On iPhone, ensure the system is up to date and review profiles and device management. These checks are not exhaustive, yet they form a reasonable first pass after a remote-access attempt.
Reporting and Follow-Up
File a report with the FTC
Submit the incident at ReportFraud.ftc.gov. Include the phone number that called, the brand the scammer claimed to represent, and whether remote access was granted. FTC reports help track the volume and methods of tech-support fraud.
Contact Microsoft or Apple only through official channels if needed
If you believe a genuine account issue exists, reach the companies through the support pages on their official websites or through numbers published there. Do not use any number supplied by the original caller. Official support will never demand remote access as a first step in an unsolicited call.
Monitor accounts for several days after the incident
Enable login and transaction alerts where available. Review email for password-reset messages you did not request. Continued monitoring catches delayed attempts that begin after the initial remote session ends.
Update the household’s awareness of this tactic
Tech-support scams succeed in part because the story sounds plausible. A short conversation with other adults and older relatives about the core rule—real Microsoft and Apple support do not make unsolicited calls demanding remote access—reduces the chance of a repeat incident.
No comments yet — be the first to share a thought.