A security solution that detects identity-based threats and suspicious activities in on-premises Active Directory environments
Treat this as a tech-support scam and do not contact that number again: genuine Microsoft error and warning messages never include a telephone number, so the claimed name and “Microsoft ID” should not be considered proof of identity.^1^
Microsoft Learn Q&A cannot verify whether a named individual works for Microsoft. Scammers commonly invent employee names and identification numbers and may spoof legitimate-looking telephone numbers.
What to do now
- If you only spoke by phone: block the number and do not provide passwords, payment details, verification codes, or personal information.
- Report the incident: use Microsoft’s scam-reporting page: https://www.microsoft.com/reportascam
- Close the alert or browser. If it will not close, press Alt+F4 or restart the computer.^2^
If remote access was allowed
- Disconnect the computer from Wi-Fi or unplug its network cable.
- Open Settings → Apps → Installed apps, sort by installation date, and uninstall any remote-access application the caller asked you to install.
- Open Windows Security → Virus & threat protection → Scan options → Full scan, then install available updates from Settings → Windows Update → Check for updates.
- From a different, trusted device, change passwords for your Microsoft account, primary email, banking, and any account accessed during the session. Use unique passwords and enable multifactor authentication.
- If the caller had prolonged control of the device or suspicious behavior continues, consider resetting Windows. A reset can remove applications and data, so back up essential personal files first. Microsoft specifically recommends considering a reset after scammers have accessed a device.^1^
If information or money was provided
- Contact the card issuer or bank immediately, dispute any charges, and request replacement cards where necessary.
- Change affected passwords from a trusted device.
- Notify local law enforcement if money, identity documents, or sensitive financial information were taken.
For future support, initiate contact yourself through Microsoft Support rather than using a number displayed in an alert. Remote assistance should be permitted only when the interaction was initiated directly with Microsoft Support.^3^
References