SCAM: Fake Windows security pop-up

This article is based on what happened, in the real world, this week. No scaremongering, no what if’s, this is a true story, which could happen to anyone.

A pop-up message appeared on a computer, saying there were Windows security problems on the computer, and the person using the computer should contact a free phone number to resolve the issues. Now this in itself, should have the alarm bells ringing – the fact it’s a message appearing with a freephone number on is a serious red flag. 

And, before the tech’s out there start jumping up and down saying “Well, how did the message get on there”, I’m not getting weighed down by that, not because it’s not important, but because there are more important lessons here.

LESSON NUMBER ONE: Do not call the freephone number, or if you receive a random phone call from someone you’ve never spoken to before, telling you that you have computer problems – put the phone down! Instead, call your IT Support provider/call that friend for advice.

The freephone number was called, and the scammer on the other end of the call went about obtaining remote access to the computer using a tool called UltraViewer. The scammer then put a message on the screen of the computer to say that the files were encrypted, and whilst I can’t confirm this, I assume the scam would have been to make the person pay to get the files (which weren’t encrypted) back. The scammer went on to attempt to make further changes to the computer, however, as this needed administrator access, they couldn’t get any further.

LESSON NUMBER TWO: Use non-administrator accounts for your day-to-day computer use. This goes such a long way in preventing computer viruses, malware and in this scenario, it stopped the scammers in their tracks.

At this point, because an administrator level of access was required, I think the penny dropped for the person using the computer and they put the phone down and did what they should have done in the first instance and called us for advice.

Having spoken to one of our team, a very quick assessment was done of the computer, and the software which was installed by the scammer was removed. For good measure and peace of mind, we then went about doing a full reset and reinstallation of Windows. Some people might say this is extreme, but quite honestly, it’s not – when you know what you’re doing you can do a full rebuild of a computer in an hour. Time is well spent to have the element of doubt removed that the scammer might still have some kind of remote access.

LESSON NUMBER THREE: If your computer has been accessed by a scammer, you should back up your important files and do a full reset/full reinstallation of Windows.

The computer was fully reinstalled (and of course, Cyber Security software was installed) and set up for the person, once again as a non-administrator, and off they went. They of course realised they shouldn’t have phoned the dodgy freephone number, and called us in the first instance – but we’re all human, and we can all get caught off guard.

LESSON NUMBER FOUR: Take a step back, pause and think. Is this really a legitimate thing you’re being asked to do? Have you spoken to this person before? Get a second opinion!

So, please take care, and put the technical solutions in place to help minimise scammers. In this instance, it was the lack of administrator access which saved the day and stopped things going further. Alongside the technical solutions, try to pause and think. Don’t be scared to put the phone down so you can think and get advice.

Gavin Moorhouse is the owner of Lucid Computer Solutions, an IT Support and Cyber Security business serving Worcester and the surrounding areas. He doesn’t have a random freephone number for you to call him on.