In this guide · 8 sections
- 01How the fake Microsoft support scam works
- 02Signs it is a scam, not a real Microsoft warning
- 03How to close the fake pop-up safely
- 04If you gave remote access or bank details: first hour
- 05After the scam: check the PC for leftovers
- 06How to stop it happening again at work
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Do not call the number. Microsoft does not put phone numbers in its warnings. Close the browser (press Esc or F11 to leave full screen, or use Task Manager). If you already let someone connect, disconnect from the internet, call your bank, then remove the remote-access app and change passwords from another device.
How the fake Microsoft support scam works
According to the SPF and CSA joint advisory released on 10 June 2026, there were at least 10 reported cases from February 2026, with losses of at least S$1.7 million. The pattern is consistent:
- a browser pop-up claiming to be from Microsoft says the device has been hacked or compromised;
- it asks you to call a 'technical support officer' on an internet-based eight-digit number starting with 3;
- the call is transferred to someone posing as a police officer, who says your device was used for money laundering;
- you are told to transfer money or give banking credentials to 'help the investigation';
- in some cases you are asked to install a remote-access app or click a link that lets them take over your bank account.
Victims usually find out when unauthorised transactions appear. For a business, the same script can hit the finance PC, which may hold corporate banking tokens and saved logins.
Signs it is a scam, not a real Microsoft warning
The advisory states that Microsoft does not include phone numbers in its error or warning messages. Real Windows Security alerts appear in the Windows Security app or a small notification, not as a loud full-screen web page.
| What you see | Scam pop-up | Real Windows alert |
|---|---|---|
| Where it appears | Inside a browser tab, often full screen | Windows Security app or a small system notification |
| Phone number | Yes, often an 8-digit number starting with 3 | Never |
| Sound and urgency | Alarms, countdowns, 'do not shut down' | Calm message with a button to scan or update |
| What it asks | Call, pay, install remote-access software | Run a scan or restart for an update |
| Closing it | Seems impossible, keeps reopening | Closes normally |
Phone calls work the same way. Microsoft, the police and government agencies will not call you out of the blue to fix your computer, ask you to install apps from outside the official stores, or transfer your call to the police. The advisory says government officials will never ask you to transfer money or disclose banking log-in details over a call or email.
How to close the fake pop-up safely
If you have not called anyone or clicked anything, you are almost certainly fine. The pop-up is a web page, not a virus on your computer.
Do not call the number or click inside the pop-up
Buttons such as 'Close', 'Scan' or 'Cancel' inside the page can be links. Ignore them all.
Leave full-screen mode
Press F11 on Windows, or the Esc key. The advisory notes some pop-ups force full screen to look like a system message.
Close the browser
Use the X on the browser window. If it will not close, press Ctrl + Shift + Esc to open Task Manager, select the browser and choose End task.
Do not restore the session
When you reopen the browser, decline any offer to restore the previous tabs, or the pop-up comes back.
Run a scan and clear notifications
Run a full Microsoft Defender or antivirus scan. In browser settings, remove any site you do not recognise from the list allowed to send notifications.
If you gave remote access or bank details: first hour
The advisory lists seven actions for anyone who believes they have fallen for the scam. In order, for a business computer:
Disconnect the computer from the internet
Pull the cable, switch off Wi-Fi or power it down. This stops the scammer's live session.
Call your bank to stop transactions
Use the number on the back of your card or the bank's website, from a different phone. For corporate accounts, ask the bank to freeze online banking until you have reviewed payees.
Remove apps installed on the scammer's instructions
Uninstall remote-access tools such as AnyDesk, TeamViewer, UltraViewer or anything you do not recognise, and check that they no longer run at start-up.
Run a full antivirus scan
Delete or quarantine whatever it finds. A clean scan is not proof the machine is safe, so keep going.
Change passwords from a separate, trusted device
Start with banking, email and Microsoft 365 or Google accounts, then anything saved in that browser. Sign out all other sessions.
Remove unauthorised bank payees
Check for payees or transaction limits that changed during or after the call.
Report to the police and SingCERT
File a police report, and report to CSA's SingCERT through the reporting form or singcert@csa.gov.sg. Call the ScamShield Helpline on 1799 if unsure.
After the scam: check the PC for leftovers
Once the scammer had remote control, assume they could see everything on screen and anything saved in the browser. Before that PC goes back into normal use:
Post-incident PC check
Email is the account scammers most often reuse. If you see strange rules or logins, follow our business email hacked guide. If files on that PC start to look renamed or encrypted, switch to our ransomware steps. If customer or staff personal data was on the machine, start a PDPA breach assessment: the breach notification guide explains the 3-day rule.
How to stop it happening again at work
The advisory recommends the ScamShield app, transaction limits on internet banking, two-factor authentication on banking apps, and keeping security software updated. For a small office, add a few rules:
- staff never call a number shown in a pop-up, and never install software because a caller asks;
- remote-access tools are blocked unless IT approved them;
- finance staff use a separate browser profile, or a separate device, for corporate banking;
- bank transfer limits are set low enough that one mistake is recoverable;
- everyone knows to unplug first and call the owner second, without fear of blame.
Endpoint protection also helps: modern tools block many scam sites and alert you when remote-access software is installed. Our guide on Defender for Business versus regular antivirus explains the options.
Do it yourself or get help?
If you only saw a pop-up and closed it, you can handle this yourself: close, scan, done. If someone had remote access to a work computer, or an email account may have been used, get a second pair of eyes.
Our Hacked Email Recovery (S$290) locks attackers out, removes hidden forwarding rules, revokes suspicious app connections and gives you a written timeline for your records. To make every office PC harder to trick, the Antivirus and Endpoint Protection Rollout (S$390) sets up business-grade protection with alerts sent to you.
Frequently asked questions
No. The SPF-CSA advisory states that Microsoft does not include phone numbers in its error or warning messages, and Microsoft does not make unsolicited calls to fix your computer. If someone calls claiming to be Microsoft, or a pop-up tells you to call a number, it is a scam. Hang up or close the browser.
Usually not. The fake warning is a web page designed to scare you into calling. If you did not call, click links inside it or install anything, closing the browser and running a full antivirus scan is normally enough. Also remove any unknown website from the browser's list of sites allowed to send notifications.
In Singapore, eight-digit numbers starting with 3 are internet-based phone numbers. The SPF-CSA advisory notes that the fake pop-ups in this scam ask victims to call such numbers. A legitimate company may use one, but no genuine Microsoft or government warning will ask you to call one from a pop-up.
Report to the Singapore Police Force, and to CSA's SingCERT by email at singcert@csa.gov.sg or through its online reporting form. If you lost money or gave banking details, call your bank first. The ScamShield Helpline on 1799 can help if you are unsure whether something is a scam.
Not always, but it is the safest option if the scammer had a long session, installed several programs, or you cannot tell what they changed. At minimum, remove remote-access tools, run a full scan, check for new user accounts and change every password saved on that computer from another device. When in doubt, reset it.