Microsoft does not make an unsolicited support call a reason to install remote-access software, reveal credentials or move money. End the contact, disconnect the device if access was granted, secure financial and online accounts from a clean device, preserve evidence and report through the appropriate Singapore channel. CSA and SPF technical support scam advisory. SingCERT Cyber Aid.
Choose the branch that matches your case
| Situation | Next step |
|---|---|
| Only received a suspicious call | Hang up and verify independently |
| Installed remote-access software | Disconnect the device from networks |
| Shared bank or card information | Call the bank fraud line immediately |
| Credentials or files may be exposed | Reset from a clean device and report the incident |
Recognise the pressure sequence
The scammer claims there is malware, a licence problem or suspicious activity, then pushes the victim to install remote-control software or reveal a code. CSA and SPF technical support scam advisory.
Urgency and technical jargon are tools to remove independent verification. Do not continue the call while checking.
Stop remote access safely
If remote control was granted, disconnect Wi-Fi and any network cable. Do not let the caller guide the cleanup. SingCERT Cyber Aid.
Use a separate trusted device to contact the bank, provider or security professional.
Protect money first when needed
If banking credentials, card data or transactions are involved, call the financial institution through the number on its official site or card.
Ask for account protection, transaction review and the bank incident reference. Speed matters more than explaining every technical detail first.
Secure online identities
Change exposed passwords from a clean device, starting with email and financial accounts. Revoke unknown sessions and enable multi-factor authentication.
Do not reuse the new password on another service. A compromised email account can reset many others.
Preserve evidence
Save the caller number, messages, payment details, software name, screenshots and timeline without engaging the scammer again.
Evidence helps the bank, Police and incident responders trace what happened.
Clean or rebuild the device
Remote software removal alone may not prove the device is safe. Run trusted security checks and consider professional assessment or a clean rebuild where sensitive access occurred.
Back up essential personal files carefully and avoid copying suspicious programs.
Use the correct report channel
Police handle scams and crime reports; SingCERT Cyber Aid accepts Singapore-based cybersecurity incidents. Banks handle account and transaction protection.
One report does not replace the others when both money and device compromise are involved.
Build a dated decision record
Write down the exact outcome you need: interrupt remote access and secure the device, accounts and money in the correct order. Keep the household, company, product, trip or booking facts that produced the result beside it. A result based on different facts is not a precedent, even when the headline issue looks similar.
Record the date and the controlling page you checked. For this decision, the source set is CSA and SPF technical support scam advisory; SingCERT Cyber Aid. Save the relevant reference number, model, class, property detail, deadline, service route or ticket choice. That makes it possible to reconstruct the decision if a rule, inventory position or personal fact changes.
Use two working aids instead of a single yes-or-no note. First, make a money-device-identity response order. Second, add an evidence-preservation incident log. The first shows how the facts map to the official rule or live service; the second exposes the timing, cost, trade-off or follow-up action that a simple eligibility answer can hide.
Set a stop condition before acting. Pause if you encounter letting the caller supervise verification, deleting all evidence, resetting passwords on the compromised device, or if any fact no longer matches the source you checked. Re-run the relevant official tool or contact the competent organisation. The purpose of the record is not paperwork for its own sake. It prevents an old screenshot, rough estimate or remembered rule from becoming an expensive assumption.
Run a final preflight
Before committing money, submitting a form, changing a legal record, starting the trip or relying on the plan, read the opening answer again against your own facts. Confirm who is affected, which date controls, what evidence is still current and which organisation has authority to decide the case. If one of those elements is missing, the decision is not ready.
Then assign the next action and a review date. The action may be a filing, a call, a booking, a household discussion or a fresh check of the live service. Keep the answer from CSA and SPF technical support scam advisory beside the supporting detail from SingCERT Cyber Aid. This two-source preflight is deliberately short: it is the last chance to catch a stale rule, misunderstood threshold or unsupported assumption before it becomes harder to reverse.
Work the example before the real decision
A caller spends 12 minutes persuading a user to install remote software, but no password or bank detail has been entered. The priority is to end the session, disconnect the device, preserve the software name and obtain a trusted security check, rather than calling the number back.
Reader checklist
- End the call
- Disconnect the affected device
- Use a clean device for help
- Call the bank if money is exposed
- Change critical passwords
- Preserve the timeline
- Report to the relevant authorities
Mistakes to avoid
- Letting the caller supervise verification
- Deleting all evidence
- Resetting passwords on the compromised device
- Paying a support fee
- Assuming uninstalling proves safety
Related next reads
After interrupt remote access and secure the device, accounts and money in the correct order, check a suspicious message. You can also handle another consumer warning.
Questions readers ask
Should I call the displayed number back?
No. Use contact details independently obtained from the official organisation.
What if remote access was installed?
Disconnect the device and obtain trusted security help.
Where can a cyber incident be reported?
SingCERT provides the Cyber Aid reporting route for Singapore-based incidents.
