Back to security guides

    2026-08-10

    Fake Microsoft Support Popup: What to Do If You Let Them In

    As of 08/2026: a fake Microsoft support popup should be treated as a scam unless verified through Microsoft directly. If someone was allowed to remote into the computer, disconnect the computer from the internet, change important passwords from a clean device, call the bank if payment data was shared, and schedule a device and account check.

    What changed?

    This guide was added because local support-scam calls often involve more than a browser popup. The scammer may have installed remote-access software, copied saved passwords, changed email rules, or pushed the victim toward gift cards, wire transfer, Zelle, or card payment.

    What should you do right now?

    Disconnect the computer from Wi-Fi or Ethernet so the remote session cannot continue. From a different clean phone or computer, change passwords for email, banking, Apple ID, Google, Microsoft and any business accounts. Call the bank or card issuer using the number printed on the card, not a number from the popup.

    What may be left on the computer?

    A support scammer may leave remote-access tools, browser extensions, hidden startup items, new Windows users, saved-password exports, fake security software, or scheduled tasks. A normal quick scan may miss these because the tools are often legitimate remote-support programs used for criminal access.

    Scam cleanup checklist

    Area to checkWhy it mattersSafe response
    Remote-access appsScammer can reconnectRemove and verify startup entries
    Email forwarding rulesIncoming mail can be copiedAudit rules, aliases and app passwords
    Browser saved passwordsCredentials may be copiedReset high-value accounts from clean device
    Bank and card accessFraud may continue after the callNotify bank and monitor transactions
    Microsoft account securityDevice and cloud files may be exposedRevoke sessions and enable MFA

    How Virus Pros handles support-scam cleanup

    Virus Pros removes remote-access tools, checks persistence, reviews account exposure, audits email rules, and rebuilds account security. For business users, Virus Pros also reviews Microsoft 365 sign-ins, mailbox forwarding, MFA status and suspicious OAuth app permissions.

    Frequently asked questions

    Is a fake Microsoft popup a real virus?

    Sometimes it is only a scam webpage. If remote access was allowed or software was installed, the computer and accounts need a deeper check.

    Can you get my money back?

    Money recovery goes through your bank, card issuer, payment app or law enforcement. Virus Pros can document the event and secure the device and accounts.

    Should I keep using the computer?

    No. Disconnect it from the internet and use a different clean device for password changes and banking until the affected computer is checked.

    Need incident help now?

    Call Virus Pros before rebooting, wiping, restoring, or paying anyone.

    Call (936) 251-6130
    Call Now — (936) 251-6130