In this guide · 8 sections
- 01Legitimate remote support vs tech support scam
- 02What to do if a pop-up says your computer is infected
- 03Remote support tools: which are safer
- 04Unattended access: convenient, and a standing risk
- 05How to check and remove remote access from your PC
- 06Rules for staff in a small business
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Remote support is safe when you started the contact with a provider you chose, you approve each session and can watch it, and access is removed afterwards. It is a scam if a pop-up, call or message asks you to install a remote tool, call a number, or log in to your bank while connected.
Legitimate remote support vs tech support scam
The tool is often the same. What differs is who started the contact and what you are asked to do.
Signs of legitimate support
- You contacted the provider first, through their website or a number you already had
- You know who they are and what you are paying, before the session
- They ask you to approve the connection and you can watch
- They explain what they are doing and disconnect when done
- Payment by invoice or through their official checkout
Signs of a scam
- A browser pop-up says your PC is hacked and gives a phone number
- An unexpected call claiming to be Microsoft, your bank, or the police
- Pressure to act immediately, or threats of legal trouble
- Being asked to open your bank app or online banking while they are connected
- Requests for gift cards, crypto, or a bank transfer to "secure" your money
The SPF and CSA joint advisory of 10 June 2026 describes the current pattern: a fake Microsoft pop-up gives an internet phone number starting with 3; the "technical support officer" then transfers the victim to a fake police officer, who claims the device was used for money laundering and asks for bank transfers or remote access. The advisory reports at least 10 cases since February 2026 with losses of at least S$1.7 million. It also states plainly that Microsoft does not include phone numbers in its error or warning messages.
What to do if a pop-up says your computer is infected
These are the steps from the SPF-CSA advisory, in plain terms.
Do not call the number or click anything in the alert
No real Microsoft, Apple or antivirus warning asks you to phone someone.
Exit full screen
Press F11 on Windows, or Escape. Many scam pages lock the browser in full-screen mode to look like a system error.
Close the browser
If the page will not close, open Task Manager (Ctrl + Shift + Esc) and end the browser process.
Check with your own IT provider
If you are worried, contact the support company you already use, through details you already have, not the pop-up.
Report it if you engaged with the scammer
Call your bank immediately, then report to the police and to CSA's SingCERT. The ScamShield helpline is 1799.
If someone already connected to your PC, follow our guide on what to do after a Microsoft tech support scam: disconnect from the internet, call your bank, remove the installed tools, scan the device and change passwords from another device.
Remote support tools: which are safer
Any of the common tools can be used safely by a legitimate provider. These features make abuse harder.
| Tool | How a session starts | Notes |
|---|---|---|
| Windows Quick Assist | Helper signs in with a Microsoft account and gives you a time-limited code; you enter it and approve screen sharing | Built into Windows; nothing to download from a link |
| AnyDesk, TeamViewer and similar | You share an ID; you accept the incoming connection | Popular with scammers too; can be set up for unattended access |
| Managed support agent (RMM) | Installed by your contracted IT provider on company devices | Suits ongoing support; check who has access and how it is logged |
Microsoft's Quick Assist documentation says the helper must sign in with a Microsoft account, the code is time-limited, and you get a permission prompt before screen sharing starts. You can also choose to share your screen only, rather than give full control.
Unattended access: convenient, and a standing risk
Unattended access lets a provider connect without anyone at the PC accepting. It is useful for servers, reception PCs and overnight maintenance. It also means that if the provider's account or password is stolen, an attacker can walk in too.
- Only with a contract: allow unattended access only for a provider you have a written agreement with, on company devices.
- Strong login and MFA: the provider's remote tool account should use multi-factor authentication.
- Named technicians: ask who can connect and whether each technician has their own login.
- Session logs: ask for logs of who connected, when, and for how long. Review them occasionally.
- Removal on exit: when the contract ends, the tool and any access must be removed from every device.
Choosing a support provider in the first place? Our guide on how to choose IT support in Singapore lists the questions to ask, including how they handle remote access.
How to check and remove remote access from your PC
Do this after a one-off support job, when changing IT providers, or if you suspect a scam.
Remote access clean-up
Scammers often follow up by email or WhatsApp pretending to be the same "support" team. Our guide on how to spot a phishing email helps staff recognise the next attempt.
Rules for staff in a small business
One staff member installing a remote tool for a scammer can expose company email, files and banking. A short written rule helps more than any software.
- Only the named IT provider may connect remotely, and only after the staff member contacted them.
- Staff never install remote tools because of a pop-up, call, SMS or WhatsApp message.
- Anyone who clicked or called reports it immediately, without fear of blame.
- Company PCs run endpoint protection that can block unapproved remote tools.
- Staff do not use admin accounts for daily work, so they cannot install software on their own.
Do it yourself or get help?
For a one-off problem, use a provider you choose yourself, watch the session, and run the clean-up checklist afterwards. That covers most risk.
Our Quick Fix (1 hour) service (S$119) is up to an hour of remote work on one clearly defined task. You book it yourself through our site chat, you decide what access to give, and you get a written summary of what was done. For a team, our Antivirus & Endpoint Protection Rollout (S$390) adds protection that can block unapproved remote tools and scam pages across every PC.
Frequently asked questions
Yes, if you contacted a provider you chose, you approve the connection, you can watch the session and the access is removed afterwards. It is not safe if a pop-up, unexpected call or message asked you to install a remote tool. Legitimate technicians never ask you to log in to your bank while connected.
No. The SPF and CSA joint advisory of June 2026 states that Microsoft does not include phone numbers in its error or warning messages. A browser pop-up claiming your PC is hacked with a number to call is a scam. Close the browser and do not call.
They are legitimate tools used by real IT providers, but scammers use them too. They are safe when you knowingly connect with a provider you trust and accept each session. Uninstall them after one-off support, and turn off unattended access unless you have an ongoing contract with a provider using strong logins.
Disconnect the computer from the internet or switch it off, call your bank to stop transactions, uninstall the remote tool, run a full antivirus scan, change passwords from a different trusted device, remove unknown bank payees, and report to the police and CSA's SingCERT. The ScamShield helpline is 1799.
Only if you have a written support contract and need it, for example for servers or after-hours maintenance. Ask for multi-factor authentication on their remote tool, individual technician logins and session logs. When the contract ends, make sure the tool and access are removed from every device.