Last Updated on April 15, 2017 by Dave Farquhar
It was bedtime and the phone rang. “Unknown name,” my Caller ID said, and the phone number was “1.” Sounds legit, right? No? I picked it up anyway. There was an audible delay after I said, “Hello.”
“Hello?” a distant voice said. “Hello?”
“Hello,” I said.
“Hello. My name is ‘Daniel,’ and I’m calling from ‘Windows Technical Support.’ How are you this evening?”
I really wanted to tell him my name was something obviously non-American, but I couldn’t think of anything so I told him I was fine. Next time I’m going to tell him my name is “Dhanesh.” After an introductory ramble, “Daniel” said my computer was sending alerts because it had lots of errors, and it was impossible for me to see them.
“Impossible for me to see them?” I asked, trying to sound fascinated.
“That’s right,” he said. “They are impossible for you to see. Both the alerts and the errors are impossible for you to see.”
“What if I put a packet capture on it?” I asked.
“They are impossible for you to see,” he said.
“But if I put a packet capture on, then I can see what my computer is sending over the network,” I said.
“What?” he asked.
“Do you know what a packet capture is?” I asked.
“No,” he admitted with an awkward pause. I’ll bet that wasn’t in his script. In his moment of weakness, I went in for the kill.
“It lets you see everything that’s traveling on your network. If you want to progress beyond sitting on a helpdesk, it might be a good idea to learn what a packet capture is,” I said.
And with that, “Daniel” hung up on me. How rude. And only one minute, forty-five seconds into the call. I think that’s a new record.
None of this should be news to anybody, but this is still a scam. Maybe their scare tactics involving harmless event log messages aren’t working well anymore, or maybe they’re just too time-consuming, but if your computer is silently doing bad things, this isn’t the way Microsoft is going to deal with it.
Let me quote Microsoft itself: “Neither Microsoft nor our partners make unsolicited phone calls (also known as cold calls) to charge you for computer security or software fixes.”
But hey, if you want to have a little fun, if someone with a single-digit phone number calls you with a claim like that, play along for about a minute, then say, “Hang on, let me fire up a packet capture so I can check this out, this sounds cool! Hey, since you’re technical support, you’ll know this. Can I run a packet capture on my switch, or do I need to put the computers on my old 10-meg hub?”
Why tell these guys you’re smarter than them when you can show them?
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.
+1
I don’t know what a packet capture is, too. But hey, I know it’s a scam because I get updated by reading the posts at http://www.callercenter.com. There’s even the scammer phone number that allows me to block it in advance.
Thanks for the link. I searched for the last call like this I got (1-949-000-7676) and there were no complaints listed, so I entered one. This particular call spoofed a phone number of “1,” so there wasn’t much I could do about it.
AT&T only lets me block 10 numbers, so trying to block numbers in advance wouldn’t do me much good. I figure I’m doing a bit of public service by reporting on these criminal tactics, since their methods and pitch do change from time to time.
These calls rarely come from valid numbers, so phone companies could really cut down on these calls if they would just block calls from invalid phone numbers (make it optional if need be), but that’s the kind of pro-consumer feature that phone companies generally aren’t known for.