Fake Microsoft support call at work

Fake Microsoft support call at work

A fake Microsoft support call at work is a social-engineering call that claims your licence expired, your PC sends errors, or “security” must install remote access now. Real IT partners and Microsoft do not ask reception to hand over a screen share without a ticket you opened yourself. Put the phone down, note the number, and use your internal IT line or managed service provider number from your contract. Fraud remains the largest share of voluntary NCSC (BACS) reports (half-year report); phone scams overlap with phishing mail and fake invoice threads.

This article is for reception, assistants, and team leads in a Swiss company with 20 to 250 staff. Consumer advice from German helpdesks does not match your helpdesk process. How to spot phishing mail is covered in how to spot phishing emails. Choosing an awareness provider is a separate decision, discussed in choosing a security awareness provider.

What callers usually say

The script changes. The pattern repeats: pressure, technical jargon, and a tool you must install immediately. Public websites and LinkedIn supply names; a caller who knows your name has proven nothing.

• Licence”Expired”

  Microsoft 365 runs through your partner or admin portal, not through a cold call to reception.

• Errors”Your PC is reporting”

  Without a ticket from you, nobody can credibly know which machine is “sending errors”.

• Urgency”Locked in ten minutes”

  Time pressure is meant to justify remote access. Your rule: hang up, then dial the published number.

Reception checklist (usable today)

At reception: the published IT number sits visibly at the desk, not only on the intranet. No transfers to private mobiles when “Microsoft” or “security” calls. Keep a notepad for caller ID, time, and claimed reason. No AnyDesk, TeamViewer, or “help link” without a ticket you opened yourself. Take a name and number, say callbacks go through IT, and end the call.

Rules you can publish internally

1. One published IT number

   Post the MSP or internal extension on the intranet and at reception. All IT contact goes through it.

2. No ad-hoc remote tools

   Remote support only with a scheduled slot and named technician.

3. Escalation word

   If someone feels pressured, they may end the call without explaining.

4. Reporting path for suspicion

   Ticket or mailbox the IT team reads daily. Number and time are enough for the first entry.

How this differs from other phone scams

Callback phishing often starts with mail or SMS: “Call this number.” You dial. Fake Microsoft support calls you and wants action now. Both are social engineering; your firm rule is the same: published channel only, no spontaneous remote tool.

CEO fraud targets payments and urgent approvals, not screen sharing at reception. If the caller asks for a transfer or a new IBAN, finance owns that thread, not the IT hotline.

This is not the general vishing glossary and not a tutorial on blocking Teams calls. It is not legal advice on recording calls.

If remote access already ran

End the remote session in the software or disconnect the network if IT asks you to. Report immediately: who granted access, which tool, what time. Your partner rebuilds the PC per policy, checks accounts, and looks for newly installed software. Log one ticket: date, number, what was requested, whether access was granted. Most SMEs skip forensics but still need a closed list of actions.

After-hours and mobile calls

Attackers call when the real MSP is closed, hoping you accept “emergency” remote access. Publish that out-of-hours work always goes through the on-call number on the intranet, never a number from caller ID. Mobile display can be spoofed; assistants do not start screen sharing on a phone without a ticket.

Coordination with your MSP

Add a line to your IT contract review: technicians introduce themselves with a ticket number you opened. Reception forwards unknown IT calls to a single mailbox rather than patching through. Once a year, five minutes in a team meeting: repeat the internal number, no horror stories.

Who should skip

Organisations with a security operations centre and strict remote-access policy already have playbooks; use this as onboarding for non-technical staff.

Training and reporting culture

Firms that only train on e-mail leave the phone gap open. A short slide for reception and open-plan offices closes it. Managers who punish reports will not hear about the next call.

Security awareness training covers vishing, fake IT support, and internal reporting in a live session for your company.

A made-up example

A made-up example: reception at a fiduciary with 40 staff hears “Microsoft security, your licence locks in ten minutes”. They do not name people from management, they do not start remote access, and they hang up. They then dial the IT partner number on the internal list and send the noted caller ID to the security mailbox. The person who took the call is not shamed in front of the team. Management hears about it in the next short report, not in a round mail with the employee’s name.