Cyber-criminals are continually switching tactics to trick users, even going offline to work their scams by phone. People are handing over credit card information or downloading malware thinking they are actually fixing a security problem, said security researchers.
In the antivirus cold-calling scam, call centres contacted users claiming to be support staff from Microsoft calling to make sure “the system is okay”, Graham Cluley, a senior technology consultant at Sophos, told eWEEK. The scam has other variations, with the caller pretending to be a security consultant or a representative of the user’s internet service provider.
The callers follow a script that has users look in the low-level “techy” areas within the Control Panel, Event Viewer, or the registry, with a number of scary-sounding errors, cryptic messages and warnings, Cluley said. As the user confirms seeing certain messages, or reads back various parts of the screen, the caller explains those are problems and then springs the trap.
Improved security products are making it harder for Web-based attacks and scams to succeed, but “telephones bypass the technology and go straight to the weakest link in the chain, the user,” wrote Fraser Howard, a principal virus researcher for Sophos Labs, in a blog post.
“We are suffering from our success. For 20 years we’ve been telling people they need to be aware of security,” said Cluley. Users have been told repeatedly that they should update their operating system or install patches when prompted, and scammers are now exploiting that awareness to scare users into taking immediate action, he said.
Some calls follow a slightly different script. Instead of claiming a customer service where they are “just checking”, the caller may claim to know issues already exist, saying “malicious traffic had been spotted” coming from the user’s computer, according to Howard. The script may include other phrases designed to panic the user, such as “junk and infected files”, or “destroy software, Windows and important files on my computer”.
Once the users are convinced there is something wrong with their PCs, they are sold security software that would “clean up the problem”, or it may request remote access in order to fix the issues. Cyber-criminals later exploit the backdoors the software creates, said Cluley. The downloaded file may just be a fake antivirus, or it could be more malicious and allow the criminal to take over the computer, said Cluley.
Even though the caller “just incurred an unexpected support expense”, the caller ends up feeling “relieved”, wrote Paul Ducklin, the head of technology for Sophos in the Asia/Pacific region.
Fake antivirus and malware distribution is a lucrative business, with security researchers estimating revenues of more than £65 million a year. Considering the financial rewards, scammers investing in the call centre to drive more sales is “clearly justifiable”, wrote Howard.
“Use your common sense,” said Cluley. “Users need to think about why Microsoft or some other big company would bother calling people individually to offer free support. It would be too expensive.”
However, the scam is made more effective by the fact that some companies and ISPs do call users when they notice a problem. Ducklin said users should hang up on these calls and, if they want to verify if the call was legitimate, they should call the company back on a published number.
All Cybertrucks manufactured between November 2023 and February 2025 recalled over trim that can fall…
As Musk guts US federal agencies, SEC issues summons over Elon's failure to disclose ownership…
Moonshot project Taara spun out of Google, uses lasers and not satellites to provide internet…
Pebble creator launches two new PebbleOS-based smartwatches with 30-day battery life, e-ink screens after OS…
Amazon loses appeal in Luxembourg's administrative court over 746m euro GDPR fine related to use…
Nvidia, xAI to participate in project backed by BlackRock, Microsoft to invest $100bn in AI…
View Comments
Just had one of those call. Person barely speaking English was Reading from a script (obvious) insisted the server was blinking telling us of a confirmed infection issue. Was asked to switch my computer on and to open files off-line, Which I chalanged and refused. He then became forcefull to the point of being rude. When I asked if they called everyone,he answered that they were working in our area. This rang bells to me and put the phone down. I hope the more naive people can be made aware of these tactics.
This website is great in allarming us of new scams. Thank you