Tech Support Scams

Usually a legitimate tool -- AnyDesk, TeamViewer, UltraViewer and similar. The software is genuine, which is why nothing warns you. Handing over that code gives a stranger full control of your machine and everything logged in on it.

Windows Event Viewer always contains warnings and errors on a perfectly healthy machine. The netstat command always lists network connections. Typing a word into the Run box can display it back as a fake "licence expired" message. None of this is evidence of anything.

Gift cards, bank transfer, cryptocurrency, or cash by courier. No legitimate technology company has ever accepted gift cards. A request for them is proof of fraud by itself, and it is the point to hang up if you have not already.

Do not call the number. Close the tab. If it will not close, exit full screen and then force-quit the browser -- Ctrl + Shift + Esc on Windows, or Force Quit on a Mac. Decline any offer to restore tabs afterwards.

Turn off Wi-Fi or unplug the cable. That immediately ends their control, and matters more than anything else in the first minute.

Remove it through the normal applications list, and check for anything else added the same day. If they installed unknown software or you are unsure what was changed, treat the machine as untrusted until it has been checked or reinstalled.

Not a number they gave you. Report exactly what was shown and what you sent. If they saw your banking session, ask for the account to be reviewed and secured.

Email first, then banking. Revoke active sessions where the service offers it. Do this from a phone or another computer, not the one that was controlled.

Go: open a terminal in a folder you can write to — cd ~/Desktop on macOS or Linux, cd %USERPROFILE%\Desktop on Windows.

Do: save this as uniqueid.py and run python3 uniqueid.py.

"""The 'unique licence ID' that is the same on every computer on earth."""

# What `assoc .zfsendtotarget` prints on Windows. It is a fixed identifier for
# the "Compressed (zipped) Folder" handler, shipped with the operating system.
CLSID = "888DCA60-FC0A-11CF-8F0F-00C04FD7D062"

machines = {
    "a brand-new laptop in Helsinki": CLSID,
    "a ten-year-old desktop in Lima": CLSID,
    "the caller's own computer":      CLSID,
    "your computer":                  CLSID,
}

for who, value in machines.items():
    print("%-32s %s" % (who, value))

print()
print("distinct values above:", len(set(machines.values())))
print()
print("The scammer asks you to type one command, reads this back to you, and")
print("says it is your machine's unique ID, which they already have on file.")
print("They do have it on file. So does everyone.")

You should see: four different computers with one identifier between them:

a brand-new laptop in Helsinki   888DCA60-FC0A-11CF-8F0F-00C04FD7D062
a ten-year-old desktop in Lima   888DCA60-FC0A-11CF-8F0F-00C04FD7D062
the caller's own computer        888DCA60-FC0A-11CF-8F0F-00C04FD7D062
your computer                    888DCA60-FC0A-11CF-8F0F-00C04FD7D062

distinct values above: 1

The scammer asks you to type one command, reads this back to you, and
says it is your machine's unique ID, which they already have on file.
They do have it on file. So does everyone.

This is the centrepiece of the classic version of the fraud. The caller asks you to type assoc and read out the line for .zfsendtotarget, then “confirms” it against their records — and it matches, because it is a fixed identifier that Windows ships with, naming the built-in handler for compressed folders. It is not a licence, not a serial number, and not yours.

You can verify this yourself in ten seconds on any Windows machine you have access to: open Command Prompt and type assoc .zfsendtotarget. Then do it on a second machine. The whole trick is that people have never had a reason to look.

If not: this script only prints a constant, so it cannot really fail; if distinct values prints anything other than 1, one of the four strings was altered when copying. On a Mac or Linux machine there is no assoc command — that is a Windows-only tool, and its absence is not a problem with your computer.

Go: the same folder.

Do: save this as makelog.py and run python3 makelog.py. The random seed is fixed so your file matches this page exactly.

"""Create a sample system log with the shape a working machine produces."""
import random

random.seed(7)                      # fixed, so your file matches this page exactly

SOURCES = ["bluetoothd", "gnome-shell", "kernel", "systemd", "NetworkManager",
           "cups-browsed", "wpa_supplicant", "gvfsd"]
MESSAGES = {
    "INFO":    ["started", "reloaded configuration", "connection established"],
    "WARNING": ["deprecated option ignored", "retrying in 5s", "no default route yet"],
    "ERROR":   ["failed to open device: No such file or directory",
                "timed out waiting for reply",
                "could not read property: not available"],
}

with open("system.log", "w") as f:
    for i in range(400):
        level = random.choices(["INFO", "WARNING", "ERROR"], weights=[70, 22, 8])[0]
        f.write("%-14s %-8s %s\n" % (random.choice(SOURCES), level,
                                     random.choice(MESSAGES[level])))

print("wrote system.log with 400 entries")

You should see: one line confirming the file exists:

wrote system.log with 400 entries

Nothing is wrong with the machine this log describes. It is an ordinary desktop with Bluetooth switched off, a printer that is not currently on the network, and a wireless service that retries — the everyday state of every computer anybody owns.

If not: PermissionError means the folder is not writable; cd somewhere you own. If the file has a different number of lines, the range(400) was altered.

Go: the same folder.

Do: save this as readlog.py and run python3 readlog.py.

"""Count what is in it, then look at what the counting means."""
import collections, sys

path = sys.argv[1] if len(sys.argv) > 1 else "system.log"
levels = collections.Counter()
sources = collections.Counter()

for line in open(path):
    parts = line.split()
    if len(parts) >= 2:
        levels[parts[1]] += 1
        if parts[1] == "ERROR":
            sources[parts[0]] += 1

total = sum(levels.values())
for level in ("INFO", "WARNING", "ERROR"):
    print("%-8s %4d  (%4.1f%%)" % (level, levels[level], 100 * levels[level] / total))

print()
print("errors by source:")
for src, n in sources.most_common():
    print("   %-16s %d" % (src, n))

print()
print("total entries :", total)
print("errors        :", levels["ERROR"])
print()
print("Every one of these is a normal machine talking to itself: a Bluetooth")
print("device that is switched off, a printer that is not on the network, a")
print("service retrying. None of it is evidence of anything.")

You should see: thirty-three errors on a machine with nothing wrong with it:

INFO      282  (70.5%)
WARNING    85  (21.2%)
ERROR      33  ( 8.2%)

errors by source:
   gnome-shell      6
   wpa_supplicant   5
   kernel           5
   gvfsd            4
   NetworkManager   4
   cups-browsed     3
   systemd          3
   bluetoothd       3

total entries : 400
errors        : 33

Every one of these is a normal machine talking to itself: a Bluetooth
device that is switched off, a printer that is not on the network, a
service retrying. None of it is evidence of anything.

“Thirty-three errors” is the number the caller reads out, in a concerned voice, having asked you to open Event Viewer. It is true, and it means nothing. Every computer accumulates errors continuously, because software is written to report when something it tried did not work — and a great many things a computer tries do not work, harmlessly, all day.

Check this on your own machine, so the next time you see it you are not surprised. On Windows, press the Start button, type Event Viewer, open it, and look under Windows Logs → System. On macOS, open Console from Applications → Utilities. On Linux, run journalctl -p 3 -n 50. You will find errors. You are not infected.

If not: FileNotFoundError means step 2 has not been run in this folder. The percentages should match this page exactly because of the fixed seed — if they differ, the random.seed(7) line is missing.

Go: the same folder. This is the refund version, which takes the most money per victim.

Do: save this as remote.py and run python3 remote.py.

"""Once they are on your screen, what is real and what is merely drawn?"""

def bank_page(balance):
    amount = format(balance, ",.2f")
    return ("+-----------------------------------+\n"
            "|  Everyday Account                 |\n"
            "|  Balance:  GBP %18s |\n"
            "+-----------------------------------+" % amount)

real_balance = 3120.44
print("what your bank's server actually holds:")
print(bank_page(real_balance))

print()
print("what the caller edits the page on your screen to say:")
print(bank_page(real_balance + 2000))

print()
print("money that actually moved     :", format(0.00, ".2f"))
print("what you are now told         :", "'we refunded you 2000 by mistake'")
print("what they ask you to send back:", format(1800.00, ".2f"))
print()
print("Editing text in a browser window changes nothing at the bank. It")
print("changes the picture you are looking at -- and you are looking at it")
print("because they asked you to open it while they watched.")

You should see: two bank pages, and a transfer total of zero:

what your bank's server actually holds:
+-----------------------------------+
|  Everyday Account                 |
|  Balance:  GBP           3,120.44 |
+-----------------------------------+

what the caller edits the page on your screen to say:
+-----------------------------------+
|  Everyday Account                 |
|  Balance:  GBP           5,120.44 |
+-----------------------------------+

money that actually moved     : 0.00
what you are now told         : 'we refunded you 2000 by mistake'
what they ask you to send back: 1800.00

Editing text in a browser window changes nothing at the bank. It
changes the picture you are looking at -- and you are looking at it
because they asked you to open it while they watched.

By this point in a real call the fraudster has remote control of the screen. They do not need to break into the bank; they edit what the page displays, using the browser's own developer tools or a simple text overlay, then express panic about an over-refund and ask for the difference back — by bank transfer, gift cards or cryptocurrency, all of which are irreversible.

The tell is unmissable once you know it. A refund you did not ask for, followed by a request to return part of it, is not a mistake anybody makes; no organisation recovers an error that way. And notice that the money leaving is real while the money arriving was only ever pixels.

If not: ValueError: unsupported format character means the format(balance, ",.2f") call was rewritten as a percent-format — Python's % formatting has no thousands separator, which is why the function is used instead.

Go: the same folder.

Do: save this as whocalled.py and run python3 whocalled.py.

"""One question sorts every 'support' contact you will ever receive."""

CONTACTS = [
    ("a pop-up with a phone number and a siren sound", "them", "browser page; any site can draw one"),
    ("a call saying your router is infected",          "them", "nobody can see your router from outside"),
    ("an email 'your subscription auto-renews, call'", "them", "the number is in the email"),
    ("you rang the number on the back of your card",   "you",  "you chose the channel"),
    ("you opened support from inside the bank's app",  "you",  "you chose the channel"),
]

print("%-48s %-8s %s" % ("HOW THE CONTACT STARTED", "WHO?", "WHY IT MATTERS"))
print("-" * 100)
for how, who, why in CONTACTS:
    print("%-48s %-8s %s" % (how, who.upper(), why))

them = sum(1 for _, w, _ in CONTACTS if w == "them")
print()
print("contacts initiated by them:", them, "- treat all of these as hostile")
print("contacts initiated by you :", len(CONTACTS) - them, "- these are the only safe ones")
print()
print("No operating system vendor, bank or internet provider monitors your")
print("machine and rings you about it. There is no such service. If the")
print("contact came to you, you are already at the start of the script.")

You should see: every contact sorted by who started it:

HOW THE CONTACT STARTED                          WHO?     WHY IT MATTERS
----------------------------------------------------------------------------------------------------
a pop-up with a phone number and a siren sound   THEM     browser page; any site can draw one
a call saying your router is infected            THEM     nobody can see your router from outside
an email 'your subscription auto-renews, call'   THEM     the number is in the email
you rang the number on the back of your card     YOU      you chose the channel
you opened support from inside the bank's app    YOU      you chose the channel

contacts initiated by them: 3 - treat all of these as hostile
contacts initiated by you : 2 - these are the only safe ones

No operating system vendor, bank or internet provider monitors your
machine and rings you about it. There is no such service. If the
contact came to you, you are already at the start of the script.

This is the whole defence, and it needs no technical knowledge at all: who chose the channel? If the contact reached you — a call, a pop-up, an email with a number in it, a message — then whoever is on the other end selected you, selected the moment, and selected the story. If you chose the channel, by typing an address you already knew or ringing a number printed on your own card, then nobody selected anything.

What to do when a full-screen warning with a siren appears: it is a web page, nothing more. Close the tab; if it will not close, use Task Manager on Windows (Ctrl+Shift+Esc) or Force Quit on macOS (Cmd+Option+Esc) to quit the browser entirely, then reopen it and decline to restore the previous session. Nothing has happened to your computer.

If not: if the two counts do not sum to five, a row was dropped when copying; each tuple in CONTACTS has exactly three items.