2026-08-10
Fake Microsoft Support Popup: What to Do If You Let Them In
As of 08/2026: a fake Microsoft support popup should be treated as a scam unless verified through Microsoft directly. If someone was allowed to remote into the computer, disconnect the computer from the internet, change important passwords from a clean device, call the bank if payment data was shared, and schedule a device and account check.
What changed?
This guide was added because local support-scam calls often involve more than a browser popup. The scammer may have installed remote-access software, copied saved passwords, changed email rules, or pushed the victim toward gift cards, wire transfer, Zelle, or card payment.
What should you do right now?
Disconnect the computer from Wi-Fi or Ethernet so the remote session cannot continue. From a different clean phone or computer, change passwords for email, banking, Apple ID, Google, Microsoft and any business accounts. Call the bank or card issuer using the number printed on the card, not a number from the popup.
What may be left on the computer?
A support scammer may leave remote-access tools, browser extensions, hidden startup items, new Windows users, saved-password exports, fake security software, or scheduled tasks. A normal quick scan may miss these because the tools are often legitimate remote-support programs used for criminal access.
Scam cleanup checklist
| Area to check | Why it matters | Safe response |
|---|---|---|
| Remote-access apps | Scammer can reconnect | Remove and verify startup entries |
| Email forwarding rules | Incoming mail can be copied | Audit rules, aliases and app passwords |
| Browser saved passwords | Credentials may be copied | Reset high-value accounts from clean device |
| Bank and card access | Fraud may continue after the call | Notify bank and monitor transactions |
| Microsoft account security | Device and cloud files may be exposed | Revoke sessions and enable MFA |
How Virus Pros handles support-scam cleanup
Virus Pros removes remote-access tools, checks persistence, reviews account exposure, audits email rules, and rebuilds account security. For business users, Virus Pros also reviews Microsoft 365 sign-ins, mailbox forwarding, MFA status and suspicious OAuth app permissions.
Frequently asked questions
Is a fake Microsoft popup a real virus?
Sometimes it is only a scam webpage. If remote access was allowed or software was installed, the computer and accounts need a deeper check.
Can you get my money back?
Money recovery goes through your bank, card issuer, payment app or law enforcement. Virus Pros can document the event and secure the device and accounts.
Should I keep using the computer?
No. Disconnect it from the internet and use a different clean device for password changes and banking until the affected computer is checked.
Need incident help now?
Call Virus Pros before rebooting, wiping, restoring, or paying anyone.
Call (936) 251-6130