How Scam Gran took revenge on the Windows Security scammers

“I’m going to kill you. Do you hear me? I’m going to kill you.” 

Thankfully, this isn’t how most of my telephone conversations end, but the call I received last Friday was different. 

Just after lunch, my house phone rang and on the other end was a gentleman in a call centre asking about my computer: was I the owner of the computer in my home? Yes. And was I responsible for the maintenance of it? Once again, I told him I was. 

“Ok, hello madam. I’m calling from Microsoft Windows Security. We’ve received a report from your computer that it’s infected with a virus that can steal your details and even spread to your mobile phone, iPad or other computers.” 

This is the standard opening gambit for a particularly cruel ruse that allows the caller, who is actually a malicious actor, to take control of your computer and steal your data. I say it’s cruel, because it’s reliant on the person not knowing much about computers or security, and abuses their trust to actually make them the gateway for the whole attack. 

While I’ve known about this scam for a few years, this was the first time I’d actually come across it first hand.

My curiosity got the better of me. 

Introducing Scam Gran 

One of the groups vulnerable to this type of scam is the elderly, especially as they’re more likely to be at home during the day when the calls tend to come. 

Taking advantage of this, and knowing I’d only said two words so far, I put on my best old lady voice and made myself the ideal victim. 

“Oh dear, this sounds very serious – I’m rather worried,” said my new persona, Scam Gran. 

The caller assured me it was indeed very serious and that I needed to go to my computer immediately. 

“Ok … yes I’m now at my computer.” 

“Is it on?” 

It wasn’t and Scam Gran wasn’t quite sure how to turn it on either. The young man helpfully talked me through powering up my PC and determining whether I had a laptop or a desktop. 

Having turned on my computer, the caller paused to ask me if I used Microsoft Windows – I assured him I did (this may not have been entirely true) – and how old my computer was. 

“Oh, I’m not sure, I think it’s three years old. Yes, because that’s when I got it for my birthday,” said Scam Gran. 

I imagine it must be quite tiresome for scammers who have to deal with people vulnerable to this kind of attack, as the sense of urgency in his voice was now tinged with an edge of irritability. 

The scam begins 

After explaining to Scam Gran what a browser was (“I’m not very good with technology”) and how to open Internet Explorer, he gave me a URL to visit that, he said, would allow him to disinfect my computer. 

“In the address bar at the top, type in www.teamviewer.com,” he said. 

It’s worth noting at this point that TeamViewer is a legitimate piece of software, used by both consumers and businesses as a support tool. What happened next isn’t the fault of the company but, rather, a corruption of the way the company’s software is intended to be used. 

“What can you see now on the page?” asked the scammer. 

“There’s picture of a lady with a box,” replied Scam Gran. The scammer wasn’t impressed. 

“No, at the top, madam, what can you see at the top?” 

Having established I was actually supposed to be looking at the words in the top right hand corner, I was guided to the “previous versions” download page and told to download version 7 of TeamViewer Quick Support. 

I’m not quite sure why version 7 in particular was required – possibly because of the age of my fictional computer. However, I do know why I was told to download Quick Support. The software is a lightweight version of TeamViewer, intended for quick customer support, and is a temporary file. The full version, by contrast, remains permanently installed on the person’s computer and also allows two-way communication. 

Dutifully, Scam Gran downloaded TeamViewer Quick Share to her computer, and, as instructed, clicked “yes” to run the programme and “yes” to allow it to make changes to my computer. 

I was then presented with a randomly generated nine-digit ID number and four-digit password, and the real fun began. 

The first time the scammer tried to get the details, Scam Gran had accidentally closed the window. On re-opening it, she handed over her ID and password, but got confused and got the first two numbers mixed up (she didn’t have her glasses on). This number mixing went on for another two attempts, before the scammer sternly reprimanded Scam Gran. 

“This is very serious, ok? Do not play with me.” 

After a full half hour as Scam Gran, I’d been rumbled, and admitted I was, in fact a technology journalist. 

“I’m going to kill you,” he spat, “Do you hear me? I’m going to kill you.” 

“Yeah, good luck with that.” 

And then I hung up. 

Scam Gran’s top security tips 

While I was quite amused by my time as Scam Gran, there is, of course, a darker side to this story. People are caught by this kind of scam and similar ones involving banks, phone and internet companies, or email providers. 

Fraud is a serious issue, and victims can be scammed out of money, either directly or indirectly. Additionally, because they intentionally gave over their login credentials or allowed someone unknown to access to their computer, it’s a murky legal area. 

So here are my three top tips for thwarting the scammers: 

1) Don’t click that link! 

“Dear sir or madam, we’ve noticed some unusual activity on your account. Please follow this link to reset your password.” 

No matter how legitimate an email may look, never click a link like this. Your bank, email provider, or internet provider will never ask you for this kind of information. Many banks have a section on their website – which you should navigate to directly – where you can report scams like this, usually referred to as “phishing” attacks. 

2) Microsoft Windows (in)Security 

As with Scam Gran’s experience, there are ruses that will try to frighten you into giving control of your computer to a scammer, handing over sensitive information, or directing you to a malicious link. 

“Microsoft Windows Security” won’t call you about a virus or malware on your computer – Microsoft doesn’t monitor for that kind of thing. Anyone claiming to be from this organisation is a liar. 

3) Phone phishing 

Another common phone scam is a caller pretending to be from your bank. As with phishing emails, they will often say they’ve seen unusual activity on your account and then encourage you to hand over your sort code, account number and secret answer, or perhaps your credit card number and signature strip security code. 

These scams can, in some cases, be extremely sophisticated, fooling victims into thinking they have hung up and called back a legitimate number, whereas in reality the scammer has just held the line and played a dial tone. 

Remember, you bank won’t call you and ask for your full account and security details. If you are unsure who’s on the phone, make an excuse to hang up and then call someone else you know to check your line really is clear.