An Old Scam With a New Architecture
Consumer protection groups have flagged a fresh surge in tech support scams through August 2026 — the scary pop-up, the alarm sound, the cold call claiming to be from a major software company.
The financial picture is not modest. The FBI recorded $2.9 billion in losses tied to tech support scams in 2025. Adults 60 and older are roughly five times more likely to be victimised than younger people, and victims over 60 account for something close to two-thirds of total dollar losses across all age groups. IC3 data has put senior fraud losses around $4.9 billion in a recent year, with an average loss near $83,000 per victim.
That average is the clue that something structural has changed. A fake technician selling a bogus $400 “security package” does not produce an $83,000 average. Something else is happening, and the FBI has described it directly.
The Relay
The most damaging current version of this scam uses a handoff chain. It works like this.
Stage one: the technician. A pop-up fills the screen with a Microsoft- or Apple-branded warning, an alarm tone, and a phone number. The page often displays your real IP address and the actual icon of the browser you are using — details harvested automatically from your own connection, presented as evidence of a diagnosis. You call. A calm technician confirms an infection and asks to connect via remote access software to take a look.
Stage two: the bank. After some time on your machine, the technician’s tone changes. They have found something worse than a virus — evidence that your bank accounts are being accessed, or that your identity is being used for illegal transactions. This is beyond their remit. They will connect you to your bank’s fraud department, or tell you a fraud officer will call. Someone does. They know your name, and they know what the “technician” found, because they are the same operation.
Stage three: the government. The bank officer escalates again. The activity is tied to a federal investigation — money laundering, drug proceeds, an account compromised by a criminal network. A federal investigator joins. There may be a case number. There may be a document sent to you with a seal on it, generated in seconds.
The instruction. Your funds are not safe where they are, and your own bank’s staff may be involved or compromised, so you must not discuss this with them. To protect your money and cooperate with the investigation, transfer it to a “safe” or “protected” account — by wire, by cash purchase of gold or crypto, sometimes by handing cash to a courier who will arrive at your home.
Why the Handoffs Are the Weapon
Each transfer of the call does specific psychological work, and understanding the mechanism is what makes it resistible.
It manufactures corroboration. A single stranger making an extraordinary claim invites scepticism. Three separate authorities independently confirming the same claim feels like verification — and the victim never notices that all three arrived through one phone number they called from a pop-up.
It escalates authority in the right order. Technician to bank to government is a ladder of increasing seriousness. Each rung makes the previous one retroactively credible.
It replaces the victim’s goal. The initial frame is “fix my computer.” By stage three it is “cooperate with an investigation and protect my savings.” A person who would refuse to send money to a stranger will move money to protect it from criminals — the transfer feels defensive, not credulous.
It pre-empts the intervention that stops it. The instruction not to tell bank staff, family, or anyone else is the most important line in the script, because a bank teller asking “who told you to withdraw this?” is the single most effective disruption available. Secrecy is presented as operational security in a live investigation.
Remote access supplies the props. With control of the machine, the operator can display a fake bank balance, show a manipulated web page, or open a file that appears to be an official notice. The victim is being shown their own screen and told what it means.
Protecting Yourself
No real error message contains a phone number. This is the cleanest rule available. Microsoft, Apple and Google do not put support numbers in security warnings. A number on the screen means the screen is the scam.
Close it without touching it. The pop-up will resist — full screen, alarm sound, blocked back button. Force-quit the browser, or shut the machine down with the power button. Nothing on that page can harm you; it is a web page, and it has already told you everything it knows by showing your IP address, which any website can see.
Never install remote access software at a caller’s request. AnyDesk, TeamViewer, UltraViewer and similar tools are legitimate and are the pivot point of this fraud. If someone who called you — or whom you called from a pop-up — wants access to your computer, the answer is no.
No bank, agency or company will ever tell you to move money to a “safe account.” There is no such thing. This one sentence identifies the fraud with near-perfect accuracy and is worth teaching verbatim.
No agency accepts payment or “protection” in gift cards, wire transfers, cryptocurrency, gold, or cash couriers. A courier coming to your home to collect cash or precious metals is fraud in every instance, without exception.
Treat “do not tell anyone” as the confession. Legitimate institutions never instruct you to conceal a transaction from your bank or your family. The moment secrecy is requested, the call is a crime.
Hang up and call back on a number you found yourself. Your bank’s number is on your card. Federal agencies are reachable through numbers published on .gov sites. Use a different phone if you can — and be aware that a caller may stay on the line while you believe you have hung up.
Agree a rule with older relatives in advance. Not a lecture — a single agreement: before any money moves for any reason, you call me first, and I will never be annoyed. This works because it gives the person a concrete, pre-authorised reason to break the isolation the script depends on.
If it has already happened, act within hours. Call your bank’s real fraud line, request a wire recall, freeze the accounts, and file at ic3.gov. Disconnect and have the computer professionally cleaned, then change every password from a different device. Wire recalls succeed far more often than people expect inside the first day.
The pop-up is the cheapest part of this operation and the part everyone has been taught to recognise. The expensive, effective part is the three-person theatre that follows — and the reason it works is that it never asks you to trust a stranger with your money. It asks you to protect your money from criminals. By the time the wire goes out, the victim believes they are the one being careful.
