Helpdesk fraud

How to spot a tech support scam: real companies never call you first

It usually starts with a screen that will not go away: a warning that viruses were found, that your account was accessed, or that a data export was requested — with a phone number underneath. Anyone who calls that number reaches a person who already knows what is on your screen. The Dutch Fraud Helpdesk received reports of exactly this in October 2026: scammers calling in the name of Google's helpdesk with a spoofed number, with varying but always urgent content — suspicious activity, a requested data export — and to “secure” the account you are told to hand over your 2FA code or change your passwords (Fraud Helpdesk, fake calls in the name of Google's helpdesk).

The rule that breaks the pattern is short: a real software company never calls you out of the blue about a problem on your device, and you never hand over a code or remote access — not even when the caller already knows your name, your device and your screen.

Direct answer: five checks before you share a code

1. Never call a number from a warning or a pop-up. Microsoft states it plainly: it will never proactively reach out to provide unsolicited technical support, and genuine error messages never include a phone number to call (Microsoft, technical support scams). A window that makes you reach for the phone is itself the signal.
2. Hang up and open the service yourself. End the call and go to the app or website you already know — or use contact details you looked up yourself. That is exactly the advice from the Fraud Helpdesk: hang up and find your own way to the company, instead of using the number or the link you were given (Fraud Helpdesk).
3. Never share a verification code. Not a 2FA code, not an SMS code, not a recovery code — even when the caller says he needs it to “confirm something”, and even when he seems to almost know it already. The Fraud Helpdesk names the handover of the 2FA code as the goal of these fake calls, and WhatsApp says the same about its registration code: never share it, not even with someone claiming to work for the company (Fraud Helpdesk; WhatsApp Help Center).
4. Give no remote access and install nothing. Software that lets someone else take over your computer or phone is the core of this fraud: the Dutch police describe the pattern of calling a software company's helpdesk yourself and reaching a fake agent who says he will fix your problem for a fee, along with the steps you must take if the scammer already had access to your computer (politie.nl, helpdesk fraud). Whatever you are asked to install: do not.
5. Change nothing on the instruction of someone on the line. No passwords, no recovery address, no settings, no payments — and take the time the caller is trying to take from you. The Fraud Helpdesk says it literally: do not change passwords on anyone else's instruction, and Google lists urgency as a hallmark of scams, because no reputable party demands payment or personal information on the spot (Fraud Helpdesk; Google Help, avoid and report scams).

Why the caller is so convincing

Two things make this conversation believable. The first is technique: the number on your screen can be spoofed and the window can imitate a real error message. The second is information — and that one matters more. The caller sometimes knows a surprising amount: your name, your device, what is on your screen. The Fraud Helpdesk notes that in some cases the caller held a lot of the reporter's data, possibly because the account had already been hacked (Fraud Helpdesk). So knowledge is not proof of identity: that is exactly why the request for a code is the moment to hang up.

What a detector does and does not see

Of such a warning you usually have a screenshot or a forwarded message. You can run the image through the image detector and the text through the text detector as triage: it helps you decide which message to verify first. It says nothing about the caller. A pop-up can be hand-made and show no AI signal at all, and a genuine message can pick up a signal from compression or editing. The score therefore says nothing about whether anything is actually wrong with your device or account.

What a phone call cannot tell you

• whether the caller really works for that company, even when the number matches — numbers can be spoofed;
• whether anything is wrong with your device or account;
• whether a payment request or subscription you are offered exists at all;
• whether this is fraud; only a law-enforcement body establishes that.

So treat the call as a reason for your own check, not as information about your account.

If you already shared a code or gave access

• Change the account password right away — yourself, through the official app or website, not through a link or instruction from the call.
• Sign out of every device and session you do not recognise, and check the account's recovery email address and phone number.
• Turn on (or redo) two-factor authentication with an authenticator app, so a stolen SMS code is not enough.
• If money was sent, call your bank the same day on a number you found yourself; speed decides whether a transfer can still be stopped.
• Keep everything: the number, the time, the screenshot, the conversation and the amounts. Report it to the fraud desk and, where there is loss, file a police report (politie.nl).

More checks are in the guides on a fake bank call, a fake login page, a hijacked WhatsApp account and an AI voice clone scam. To check a message or a file on its own, use the free checker.

Frequently asked questions

There is a phone number in the warning on my screen. May I call it?

No. Microsoft states that genuine error messages never include a phone number and that it never offers unsolicited technical support, so never call a number that appears in a pop-up or an error message (Microsoft).

The caller knew exactly what was on my screen. Doesn't that make it real?

No. Someone knowing your details does not prove he works for that company; the Fraud Helpdesk saw callers holding a lot of the reporter's data, sometimes because the account had already been taken over. Knowledge is not proof of identity.

Does a detector score prove that a warning is fake?

No. The score describes patterns in a file and says nothing about the sender. A hand-made pop-up can stay entirely silent while a genuine message can draw a signal from compression. Use the result as triage, never as evidence.