online-scams – Free Tech Tutor

Revoke Third-Party App Access to Your Google and Social Accounts

Revoke third-party app access to your Google, Facebook, Microsoft, and Apple accounts in minutes and finally close the old app connections you forgot about.

I found out the hard way that a food delivery app I deleted two years ago still had full read access to my Google Contacts. I only noticed after a friend’s Instagram got hijacked through an old quiz app she’d forgotten about. If you want to revoke third-party app access to your Google account and your social accounts, it takes about five minutes and no technical skill beyond clicking the right menu.

Most people sign up for a new app with “Continue with Google” and never think about it again. The real risk isn’t the app you use today — it’s every app you stopped using but never disconnected, because each one still holds a live key to your account.

Quick Answer

To revoke third-party app access, open your Google Account’s Security page and remove apps under “Third-party apps with account access.” On Facebook, Instagram, or Microsoft, go to Settings, find Apps and Websites (or Connected Experiences), and remove anything you don’t recognize or no longer use.

What Is Third-Party App Access, and Why Does It Matter?

Third-party app access is the permission you grant when you use “Sign in with Google” or “Continue with Facebook” instead of creating a new password. The app asks your account to vouch for you, and in exchange you hand it a scope of data: your email, contacts, calendar, or even the ability to post on your behalf.

That connection doesn’t expire when you stop using the app. I’ve found abandoned quiz apps, old resume builders, and a defunct budgeting tool still listed as “active” on my own accounts, each one a standing door into my inbox or photos. A stale connection is riskier than a stale password, because you can’t rotate it out of habit — you have to remove it yourself. It’s the same blind spot I cover in my 10-minute Google Security Checkup.

Every app you connected and forgot about is a live credential nobody is watching but you.

How Do I Revoke Third-Party App Access on Google?

Step 1: Open Your Google Account Security Page

Go to myaccount.google.com/permissions while signed in, or navigate manually: Google Account > Security > “Third-party apps with account access.”

Step 2: Review Each Connected App

You’ll see every app with access, plus a short description of what it can see or do. Tap any entry to expand the exact permissions — some only read your email address, others can read your Drive files or send email as you.

Step 3: Remove Access You Don’t Recognize or Need

Select the app, click “Delete all connections,” and confirm. This immediately revokes the app’s OAuth token, so it can no longer pull data from your account even if you never open it again.

Pro tip: Sort by permission scope, not app name. An app you use weekly but that only reads your basic profile is lower risk than a forgotten app with access to Gmail or Drive.

Google’s own permissions page is the single fastest place to see and cut every third-party connection at once.

How Do I Revoke Connected Apps on Facebook, Instagram, Microsoft, and Apple?

Facebook and Instagram

On Facebook, go to Settings & Privacy > Settings > Apps and Websites. On Instagram, go to Settings > Security > Apps and Websites. Both list active sessions; tap “Remove” on anything you no longer trust. I cover the rest of that lockdown in my social media privacy checkup.

Microsoft Account

Visit account.microsoft.com, sign in, and open Privacy > App access. Microsoft groups apps by what they can access, so you can spot over-permissioned apps quickly.

Apple ID

On an iPhone, open Settings > [your name] > Sign in with Apple. This shows every app using Sign in with Apple and lets you stop sharing your relay email or full identity with a tap.

Account	Where to Check	What You Can Revoke
Google	myaccount.google.com/permissions	OAuth tokens, Drive/Gmail/Contacts scopes
Facebook/Instagram	Settings > Apps and Websites	Login sessions, posting permissions
Microsoft	account.microsoft.com > Privacy	Profile, email, and file access
Apple ID	Settings > Sign in with Apple	Relay email, shared identity data

Troubleshooting tip: If an app you still use suddenly logs you out after you revoke it, that’s expected — reconnect it deliberately and check the permission list it requests this time before approving.

Every major platform hides its connected-apps list under Settings, and clearing it takes the same three steps everywhere: find, review, remove.

Common Mistakes to Avoid

Assuming deleting the app deletes the connection. Uninstalling from your phone does nothing to the OAuth token on Google’s or Facebook’s servers — you must revoke it separately.
Only checking Google and skipping social accounts. I’ve seen more abuse through forgotten Instagram quiz apps than through Google itself; check every account you use to sign in elsewhere.
Revoking access without checking what breaks. If a smart-home or fitness app relies on that connection, removing it may stop syncing until you reconnect. On Android, this overlaps with the tracking permissions in my Android privacy settings guide.
Ignoring the permission scope shown before you connect a new app. If a simple game asks for contacts and calendar access, that’s a red flag worth declining at signup, not cleaning up later.
Doing this once and forgetting it. New connections pile up every time you sign up for something with an existing account, so treat this as a recurring check, not a one-time fix.

Most mistakes here come from treating app access as a one-time setup step instead of an ongoing habit.

Frequently Asked Questions

Does revoking third-party access delete my data from that app?

No, it only cuts off future access; any data already copied to the app’s own servers stays there. When I revoked access for an old resume tool, I still had to email support separately to delete my stored resume.

Will revoking access log me out of the app immediately?

Usually yes, the next time the app tries to refresh its connection. I’ve had apps stay logged in for a session before finally prompting me to sign in again.

Is it safe to remove an app I don’t recognize?

Yes — if you don’t recognize the name, you aren’t using it, and removing it carries no downside beyond reconnecting if you were wrong. I remove anything I can’t place within five seconds.

How often should I check my connected apps?

Every three to six months, or right after a major password reset or a friend’s account gets compromised. That second trigger is what got me checking mine in the first place. If you haven’t already, pair this with switching to a passkey so the accounts you’re protecting are harder to phish in the first place.

Can a revoked app still send me spam email?

If it already has your email address stored, revoking access won’t stop emails sent to that address — unsubscribe or block the sender separately.

Conclusion

Revoking third-party app access closes doors you forgot were ever open, and it takes less time than reading this article. Open your Google permissions page now, remove anything you don’t recognize, then do the same on Facebook, Instagram, Microsoft, or Apple before you close the tab.

How to Remove Your Personal Info From Google Search Results

Remove personal info from Google search results using Google’s own free removal tool — step-by-step, no legal help needed, results in about two weeks.

Type your name into Google and you might find your home address, phone number, or old employer sitting on a random people-search site. I found my own cell number listed on three broker sites last year and needed to remove personal info from Google search fast, before a scammer used it.

The fastest fix isn’t emailing every site that lists you — it’s Google’s own Results About You tool, which lets you flag search results showing your personal data and request their removal from one place.

Quick Answer

To remove personal info from Google search results, open Google’s Results About You tool, search your name, flag any listing with your phone number, address, or email, and submit a removal request. Google reviews and removes eligible pages from search within roughly one to two weeks, though the source site may still host the data.

What Counts as “Personal Info” in Google’s Eyes?

Google targets specific categories: your phone number, home address, personal email, government ID numbers, medical records, financial account details, and images of handwritten signatures. It also covers non-consensual explicit images and doxxing content pairing your name with contact info meant to harass you.

A negative review or an old news article generally won’t qualify — Google separates personal contact data from embarrassing-but-public information, and the second almost never gets pulled. For the fuller picture of what Google already holds on you, see what data Google collects about you.

Google’s removal tool covers contact and identity data, not bad reviews or old news stories about you.

How Do I Set Up Google’s Results About You Tool?

1. Open the tool and sign in

Go to Google’s Results About You tool while signed into the Google account you search with. Google needs you signed in to match results to your real name.

2. Search your name and turn on alerts

Type your full name, plus your city if you share a name with someone else, into the search box. Turn on notifications so Google emails you when a new page mentions your phone number or address.

3. Review the flagged results

Google shows pages that already match your contact details. Scroll through each one before requesting removal, confirming the address or number listed is actually yours and current.

Setting up Results About You takes under five minutes and handles ongoing monitoring for you afterward.

How Do I Request Removal of a Specific Search Result?

1. Click “Remove result”

Next to any listing showing your phone number, address, email, or ID number, click Remove result. Google opens a short form asking which category of personal data appears on the page.

2. Pick the right removal category

Choose the option that matches what’s exposed. Contact information, financial details, and explicit imagery route to different review teams, and the wrong category just slows your request down.

3. Submit and wait for a decision

Confirm the URL and submit. Google emails a decision once a reviewer checks the page. When I submitted a request for an old address on a broker site, the confirmation came in three days and the result dropped within about two weeks.

Pro tip: Submit one URL per request instead of bundling several links into a single note. Bundled requests get bounced back for re-submission far more often in my experience.

Removal requests take a few minutes each to submit; give Google one to two weeks to act on them.

Which Removal Method Should You Use?

Google’s tool isn’t your only option — combine it with a direct opt-out to the site itself depending on what’s exposed and how urgent it is.

Method	Best For	Typical Turnaround
Results About You tool	Phone, address, email, or ID numbers showing in search	1-2 weeks
Direct opt-out to the broker site	Removing the data at the source, not just from search	2-6 weeks
Google’s explicit imagery removal form	Non-consensual images or doxxing content	A few days to 2 weeks

Combine Google’s tool with a direct opt-out request when you want the data gone from the source site too, not just from search.

How Long Does Google Take to Remove Your Info?

Most straightforward requests, like a phone number or address tied to your name, get a decision within a week or two. Complex cases, like financial account numbers or content spread across many pages, take longer since a human reviews each one.

Troubleshooting tip: If your request sits past two weeks with no update, check its status under “Your removal requests.” A rejection usually just needs a clearer URL or category fix, not a whole new submission.

Give simple removals about two weeks before you follow up on a request’s status.

Common Mistakes to Avoid

Requesting removal of public records. Court records and property deeds are public by law — ask the source agency about redaction instead of filing with Google.
Forgetting the data still lives on the source site. Google’s tool hides the page from search, it doesn’t delete it — follow up with the broker’s own opt-out form, then run through my social media privacy checkup too.
Submitting one request for multiple URLs. Each link needs its own category and gets reviewed separately, so bundling them slows everything down.
Skipping the alert setup. Without monitoring on, the same broker site can relist your info months later and you won’t know until you search again.
Using an old or secondary Google account. Submit requests from the account you actually use for search — that’s the one Google ties the monitoring to.

Frequently Asked Questions

Does removing a result from Google search delete it from the original website?
No, it only removes the page from search results, not from the site hosting it. My own old address pulled from search stayed live on the broker’s page until I filled out their separate opt-out form a month later.

Is Google’s Results About You tool free?
Yes, it’s a free feature built into any Google account. I’ve used it twice without any charge or subscription requirement.

Can I remove old news articles about myself?
Generally no. Google treats public news coverage differently from personal contact data, so an old article rarely qualifies unless it also exposes something like your phone number or ID.

What if my removal request gets rejected?
Check the rejection reason, fix the category or URL, and resubmit. My own mislabeled financial-info request went through on the second try once I picked the right category.

How often should I check for new listings of my info?
Once a quarter is enough for most people, though Google’s automatic alerts mean you don’t have to remember to check at all. If your info showed up because of a breach rather than a broker site, pair this with my guide on protecting your identity after a data breach, and lock down these Android privacy settings that stop tracking while you’re at it.

Conclusion

Removing your personal info from Google search results takes one setup pass with the Results About You tool and a few minutes per removal request after that. Open the tool today, search your name, flag the first listing you find, and check back in two weeks to see it drop.

SIM Swapping Attacks: How Scammers Hijack Your Phone Number

SIM swapping lets scammers hijack your phone number and drain accounts. Learn the warning signs and how a carrier PIN stops it cold.

I got a call from my carrier’s fraud team at 11 p.m. asking why I’d just requested a new SIM in a city I’d never visited. I hadn’t. Someone had gathered enough of my details to convince a support rep to move my number onto their SIM, and for twenty minutes it belonged to a stranger.

That’s a sim swapping attack, and it can drain your bank account without a single click. The crux: your phone number is not a secure credential, it’s account metadata a call center employee can reassign in minutes — and every SMS login you rely on inherits that weakness.

Quick Answer

A SIM swap happens when a scammer tricks your carrier into porting your number to a SIM they control, using stolen personal data. Once they have it, they intercept SMS codes and reset your accounts. Stop it with a carrier PIN, a port-out lock, and app-based two-factor authentication instead of SMS.

What Is a SIM Swapping Attack?

A SIM swap is account takeover where an attacker impersonates you to your carrier. They call support with a name, billing address, and the last four of your social security number pulled from an old breach, and request a new SIM or a port to another carrier.

Once approved, your real SIM goes dead. Calls and texts meant for you route to the attacker instead. They use “forgot password” on your bank and email, intercept the SMS code, and lock you out while they clean you out.

A SIM swap is identity theft aimed at your phone number so an attacker can pass as you during account recovery.

How Do Attackers Steal Your Number?

Every swap I’ve read about or heard from readers follows the same rough sequence.

Collecting Your Details

Attackers buy or scrape data from breaches, phishing pages, or social media (birthday, mother’s maiden name). Sites like Have I Been Pwned show how often your email appears in a breach dump.

Contacting Your Carrier

Posing as you, they call or use chat, claim a “lost phone,” and request a SIM replacement or port. Weak carrier verification is why this works.

Losing Signal, Then Your Accounts

The tell to remember: your phone suddenly shows “No Service” with no explanation. That’s not a network hiccup — it’s evidence a swap is underway. Minutes later, attackers trigger resets on email and banking using your intercepted codes.

Watch for a sudden, unexplained loss of signal followed by unexpected account-lockout emails.

How Do I Stop a SIM Swap Before It Happens?

I treat this as a five-minute setup task, because the fix is cheap and the damage is not.

Set a Carrier Account PIN

Every major US carrier lets you add a separate PIN required for account changes, including SIM swaps and ports. This differs from your phone’s lock screen PIN — find it under “account security” in your carrier account.

Enable a Port-Out Freeze

Ask your carrier for a port freeze, which blocks any transfer to another carrier until you personally remove it — this stops the most damaging version of the attack.

Move Off SMS for Two-Factor Codes

Swap SMS-based two-factor authentication for an authenticator app or a passkey wherever supported. I moved my email and banking off SMS; if you haven’t set up 2FA yet, I cover the steps in my two-factor authentication setup guide.

Use a Password Manager

A SIM swap is less useful to an attacker if your accounts don’t share a password an old breach already exposed. I run everything through Bitwarden; here’s how I set it up for free, plus my notes on passwords you can remember.

Pro tip: Ask your carrier specifically for a “SIM swap PIN” or “number transfer PIN” — some reps default to describing your voicemail PIN, which does nothing to stop a swap.

Locking down carrier access and moving off SMS codes closes the two doors attackers rely on most.

What Should I Do if My SIM Was Already Swapped?

If your phone loses service unexpectedly and you didn’t request a change, treat it as an active incident.

Call Your Carrier From Another Phone

Use a friend’s phone or web chat to report the swap and request an immediate reversal, and ask them to lock the account.

Secure Your Email First

Email is the recovery key to everything else. Change its password from a trusted device and revoke active sessions. My post-breach identity checklist covers the same triage.

Check Bank and Crypto Accounts

Log in from a secure device, review recent transactions, and call your bank’s fraud line if anything looks off — banks reverse fraudulent transfers faster within the first 24 hours.

Troubleshooting tip: If your carrier app also needs SMS verification to log in, go to a physical store with photo ID — reps there restored my service and added a security PIN in about fifteen minutes.

Reclaiming your number and email within the first hour usually stops the damage before it spreads to financial accounts.

Which Two-Factor Method Is SIM-Swap Resistant?

Method	SIM-Swap Resistant?	Setup Effort	Best For
SMS text codes	No	None (default)	Accounts with no other option
Authenticator app	Yes	Low, 5 minutes	Most personal accounts
Passkey	Yes	Low, 90 seconds	Sites that support it
Hardware security key	Yes	Medium, one-time buy	Email, banking, crypto

Anything that doesn’t touch your phone number is inherently safe from a SIM swap.

Common Mistakes to Avoid

Relying on SMS for Sensitive Accounts

Fix: switch email, banking, and crypto logins to an authenticator app or passkey first.

Skipping the Carrier PIN

Fix: set it anyway — your screen lock PIN protects the device, not your carrier support account.

Posting Personal Details Publicly

Fix: lock down birthday and family names on social profiles, since attackers use these to pass security questions.

Ignoring a Sudden “No Service” Message

Fix: treat it as urgent and call your carrier from another device.

Frequently Asked Questions

Can a SIM swap happen without me noticing?

No — the clearest sign is a sudden total loss of signal. My phone dropped to “SOS only” mid-evening with no reported outage, which tipped me off immediately.

Does a SIM swap require physical access to my phone?

No, the attacker never touches your device. They only need enough data to convince your carrier’s support team to reassign your number.

Will a new phone number stop future attempts?

Not by itself — the attacker’s real advantage is the data they’ve collected. A carrier PIN and app-based 2FA protect you regardless of your number.

Is eSIM safer than a physical SIM card?

Roughly the same risk — the vulnerability is the carrier’s verification process, not the SIM’s physical form. I still add a port-out lock on eSIM lines.

Can a password manager alone prevent a SIM swap?

No, it stops password reuse but not the carrier verification hole a SIM swap exploits. Pair it with a carrier PIN and app-based 2FA.

Conclusion

A SIM swap works because your phone number was never designed as a security credential, yet nearly every account treats it like one. Set a carrier PIN, add a port-out freeze, and move your two-factor codes to an authenticator app or passkey today.

5 Checks That Reveal a Fake App Before You Install It

Learn to spot a fake app before installing with 5 quick checks — verify the developer, read review patterns, and audit permissions in under two minutes.

Learning to spot a fake app before installing is one of the most useful habits you can build for your phone. Every year, millions of people download malicious clones that look legitimate but secretly steal personal data, serve aggressive ads, or quietly charge hidden subscriptions. I nearly fell for one myself — a flashlight app in the Play Store with polished screenshots, five-star reviews, and tens of thousands of downloads. The single most effective defence is knowing what to check in the two minutes before you tap Install.

Fake apps — also called copycat apps or malicious clones — mimic trusted software closely enough to fool careful users. The good news: once you know which signals to check, the whole routine takes under two minutes and applies to any app store on any platform.

Quick Answer

Before installing any app, verify the developer name exactly matches the official company, confirm that reviews span months rather than days, check that permissions match the app’s stated purpose, and search the developer name in your browser. If any check fails, don’t install.

How Do Fake Apps End Up in App Stores?

App store review processes catch most threats, but bad actors find workarounds. A common method: submit a harmless app that passes review, then push a malicious update weeks later. Others clone a popular app’s name and icon precisely, counting on users rushing through search results without reading carefully.

Google Play has removed fake security and utility apps after tens of thousands of installs. The Apple App Store is harder to penetrate but not immune — phishing links on social media bypass the store entirely and point users straight to malicious downloads.

Understanding how fakes slip through tells you exactly which listing signals deserve the most scrutiny.

What Red Flags Should You Check Before Installing?

1. Verify the Developer Name Exactly

The most common trick is a one-letter swap or extra word — “Whatsup Inc.” instead of WhatsApp LLC, or “Adobe System” without the “s.” Tap the developer name in the store and look at their full catalog. A legitimate publisher has dozens of well-known titles, not three apps with vague names published in the last month.

Pro tip: On Android, tap “About this app” in the Play Store listing. On iPhone, tap the developer name to see every app they’ve ever published.

2. Read the Review Dates and Patterns

A real app collects reviews over months or years. If an app shows thousands of reviews but every one was posted within the last two weeks, that’s a paid-review farm. Look for a range of star ratings — genuine apps have unhappy users who name specific bugs. Rows of five-word five-star praise (“Great app!! Works perfectly!!”) repeated by dozens of accounts is a reliable signal to walk away.

3. Audit the App Permissions Before Downloading

On Android, tap “About this app” then “App permissions” in the Play Store listing before you download. On iPhone, permission prompts appear on first launch. A flashlight app that requests access to your contacts and microphone has no legitimate reason for either. I once installed a battery optimizer that wanted SMS read access — a permission no battery tool ever needs — and removed it within minutes.

Troubleshooting tip: After installing any app, open Settings > Apps (Android) or Settings > Privacy & Security (iPhone) and revoke any permission that doesn’t match the app’s stated purpose. My guide to Android app permissions explains exactly what each one accesses and which are safe to deny.

4. Read the Description and Screenshots

Legitimate apps list specific features, maintain a changelog in the “What’s New” section, and link to a real privacy policy and support page. Fake apps rely on vague copy: “Best utility performance optimizer 2024!” with no feature detail. Screenshots that show a UI unrelated to the app’s stated purpose — or generic stock photos — are a warning worth heeding.

5. Search the Developer Name Outside the Store

Spend 60 seconds searching “[developer name] reviews” or “[app name] scam” in your browser. Real apps have Reddit threads, tech-publication coverage, or an official website. If the only results are the app store listing itself, that absence is worth acting on before you download.

These five checks form a pre-install routine that takes under two minutes and catches the most common copycat patterns.

How Do Real and Fake Apps Compare?

Signal	Legitimate App	Fake / Copycat App
Developer name	Exact official company name	Subtle misspelling or added word
Review history	Spread over months or years	Clustered within days or weeks
Permissions	Match the app’s stated purpose	Overbroad; requests unrelated access
Description	Specific features, changelog, support link	Vague, generic, poor grammar
Publisher catalog	Multiple well-known titles	Few apps with unrelated names

Running this comparison against any unfamiliar listing takes under two minutes and highlights where a fake app can’t maintain the appearance of legitimacy.

Common Mistakes to Avoid

Trusting the icon alone. Copycats replicate official icons pixel-for-pixel. Always verify the developer name separately — a matching icon proves nothing on its own.
Skipping the permissions screen. Tapping “Allow” on every prompt without reading is how fake apps gain lasting access to your data. Revoke anything the app doesn’t need right after install.
Installing from links in messages or ads. Phishing links bypass app stores entirely. Navigate to the store yourself and search for the app directly rather than tapping a link someone sent you.
Treating high download counts as proof of safety. Fake review services inflate install numbers. Use download count as one signal among several, not the deciding factor.
Never rechecking permissions after an update. A clean app can gain new permissions through a later update. Revisit Settings > Apps (Android) or Settings > Privacy & Security (iPhone) every few months.

Each mistake follows the same root cause — moving too fast through the installation process without pausing to verify the basics.

Frequently Asked Questions

Can fake apps appear on the Apple App Store?
Yes, though it’s rarer than on Google Play. Apple’s review process is stricter, but copycat apps with slightly altered names do get through. The same pre-install checks apply on iOS. For broader app privacy on iPhone, see 8 iPhone privacy settings to change right now.

What should I do if I already installed a suspicious app?
Uninstall it immediately, then open Settings and revoke every permission it was granted. Change passwords for any accounts you logged into while the app was active. If personal data may have been exposed, the recovery steps in how to protect your identity after a data breach apply directly here.

Does Google Play Protect scan apps automatically?
Yes. Open the Play Store, tap your profile picture, and select Play Protect to confirm it’s enabled and run a manual scan. Google’s Play Protect support page explains exactly what it checks. On iPhone, iOS sandboxing limits what a malicious app can access even after install.

Are free apps with no obvious revenue model more suspicious?
Worth extra scrutiny, yes. An app with no ads and no paid tier may be monetising your data instead. That said, many legitimate open-source apps are genuinely free — run all five checks regardless of price, not just for apps that cost money.

These answers cover the most common questions that come up once you start applying the pre-install checklist to unfamiliar apps.

Conclusion

Two minutes of checking before you tap Install can save hours of cleanup afterward. Verify the developer name, study the review patterns, audit permissions, and search outside the store — that four-step habit filters out the vast majority of fake apps. For more on how bad actors use the same manipulation tactics in a different context, my guide to spotting tech support scams is a natural next step.

Spot a Tech Support Scam Before It Hooks You: 6 Red Flags and What to Do

Learn to spot a tech support scam fast: 6 red flags that expose fake alerts, cold calls, and phony support pages before handing over access or money.

I was halfway through a video call when a blaring alarm flooded my screen and a banner declared that Windows had detected critical infections — complete with a toll-free number to call immediately. My stomach dropped before my brain took over. Tech support scams are engineered to produce exactly that reaction, because panic is what makes them work.

According to the FTC’s consumer guidance on tech support scams, these schemes cost Americans hundreds of millions of dollars each year. The reassuring part: once you know how to spot a tech support scam, the tactics become obvious — and you can shut them down in seconds.

Quick Answer

A tech support scam uses a pop-up alarm, unsolicited phone call, or fake error page to convince you your device is infected. Microsoft, Apple, and Google never contact you unprompted about viruses. Hang up or close the tab, then run a free scan with Windows Defender or Malwarebytes.

What Are the Three Types of Tech Support Scams?

Most attacks arrive one of three ways. Knowing the delivery method makes the red flags much easier to spot.

Scam type	How it arrives	Immediate giveaway
Fake pop-up alert	A website triggers a full-screen alarm with a toll-free number	Real OS errors never include a phone number
Unsolicited phone call	Caller claims to be Microsoft, Apple, or “Windows Support”	Legitimate companies never call you about viruses unprompted
Fake search ad	Paid ad mimics the official support page for a brand	URL doesn’t end in the brand’s real domain

All three methods share the same end goal: get you on a call, convince you to hand over remote access, or pay for fake “cleanup” software.

How Do I Spot a Tech Support Scam in the Moment?

Run through these six checks whenever something feels off. Most scams fail on the very first one.

1. The Alert Includes a Phone Number

Real error messages from Windows, macOS, or any browser never display a phone number. The moment you see a toll-free number urging you to “call immediately,” you’re looking at a scam. Close the tab without dialing.

2. Someone Contacted You First

Legitimate tech companies do not make unsolicited calls to warn you about viruses or account compromises. If you receive an unexpected call from “Microsoft Support” or “Apple Security,” hang up without engaging. Scammers routinely spoof real Microsoft and Apple caller-ID numbers to appear more convincing.

3. The Page or Alarm Won’t Close

A frozen browser with a looping alarm is a scare tactic, not a real system event. Press Alt+F4 on Windows or Command+Q on Mac to force-quit the browser. If it won’t respond, open Task Manager (Ctrl+Shift+Esc) and end the browser process — the “emergency” disappears instantly.

4. They Ask You to Install Remote Access Software

Once on a call, scammers direct you to download AnyDesk or TeamViewer so they can “diagnose” your machine. They then open Windows Event Viewer — which shows harmless warnings on any healthy PC — and present those entries as proof of infection. On my freshly installed Windows 11 machine, Event Viewer listed 47 warnings straight out of the box. Every one of them was normal.

5. Payment Is Requested by Gift Card or Wire Transfer

Legitimate companies bill through secure online portals, not over the phone. Any request for gift cards, wire transfer, Zelle, or cryptocurrency is a definitive sign of a scam — without exception.

6. The URL Doesn’t Match the Real Brand

Before clicking a search result or support link, check the browser address bar. Domains like microsoftsupportcenter.net or apple-security-alert.com are not owned by Microsoft or Apple. Real Microsoft pages end in microsoft.com and real Apple pages end in apple.com.

If even one of these six signs appears, stop — the combination of urgency, unsolicited contact, and unusual payment demands has no legitimate use case.

What Should I Do When a Scam Targets Me?

If You See a Pop-Up or Fake Alert

Do not call the number on screen.
Force-quit the browser with Alt+F4 or Task Manager.
Run a free scan with Windows Defender or follow this malware removal walkthrough to confirm nothing installed itself.
Clear your browser cache (Ctrl+Shift+Delete) in case a rogue extension triggered the alert.

If You’re on the Phone With a Scammer

Hang up without explaining yourself — engagement gives them more time to manipulate you.
Block the number immediately.
Report it at ReportFraud.ftc.gov.

If You Already Gave Them Remote Access

Disconnect from the internet immediately — pull the cable or toggle Wi-Fi off.
From a separate device, change passwords for email, banking, and any accounts saved in your browser.
Enable two-factor authentication on all important accounts right away.
Run Windows Defender Offline Scan: Settings → Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan.
If you shared financial details, contact your bank and follow this identity recovery guide for the full response plan.

Pro tip: Turn on Tamper Protection before anything goes wrong: Settings → Privacy & Security → Windows Security → Virus & threat protection settings → Tamper Protection (toggle On). This blocks unauthorized software — including tools scammers try to install — from disabling Windows Defender.

Troubleshooting tip: If your browser is completely frozen on a scam page, open Task Manager (Ctrl+Shift+Esc), find your browser under Apps, right-click it, and choose End Task. When you reopen the browser, close the previous-session tab before anything reloads.

Fast action after remote access matters: the sooner you disconnect and rotate passwords, the smaller the window scammers have to use what they captured.

Common Mistakes to Avoid

Calling the number “just to check.” Engaging makes you an active target. The number is always fake — there is nothing to verify by calling.
Trusting caller ID alone. Scammers spoof real Microsoft and Apple phone numbers routinely. A matching caller ID proves nothing about who is actually on the line.
Paying to “cancel” the service. After one payment, scammers often call back claiming a refund is owed, then walk you into sending even more money.
Not changing passwords after remote access. Even if the scammer “found nothing,” they may have silently copied saved credentials from your browser while on screen.
Letting embarrassment delay action. These scams catch intelligent people every day. Report immediately to the FTC and your bank — every hour of delay helps only the scammer.

The most common thread across scam reports is the same: the victim felt rushed. Slow down, run the six-flag checklist, and the scam has nowhere to go.

Frequently Asked Questions

Can a pop-up actually lock my computer?

No — a webpage can go full-screen and loop audio, but it cannot lock your operating system. Alt+F4 or Task Manager always breaks the illusion. The first time I hit one of these pages, I was convinced my PC had crashed; Alt+F4 cleared it in under two seconds.

Is it safe to use my computer after seeing a fake alert?

In most cases, yes. The pop-up itself rarely installs anything — its only job is to scare you into calling. Run Windows Defender after closing the browser; if the scan is clean, you’re fine and can continue working normally.

What if a family member already paid the scammer?

Call the bank or card issuer immediately to dispute the charge or freeze the card. If they paid by gift card, contact the issuer’s fraud line — some amounts are recoverable if you act within hours. Then change all passwords on any account the scammer may have viewed during remote access.

How do I tell a scam email from a real Microsoft security alert?

Real Microsoft security emails come from @microsoft.com addresses and link only to microsoft.com pages — never to a phone number. When in doubt, go directly to account.microsoft.com to check your security alerts. You can apply the same pattern recognition used to spot phishing emails across any brand.

These four questions cover the moments people freeze up most — bookmark this page so you can run through them the next time something suspicious lands on your screen.

Conclusion

Tech support scams run entirely on urgency and manufactured fear — remove either and the con collapses. Keep three rules front of mind: error messages never include phone numbers, real companies never call you unprompted about viruses, and no legitimate payment request ever involves gift cards or wire transfers. Share this guide with anyone who might be a target — awareness is the one defense these scams have no answer for.