How to spot IT support scams targeting small businesses
Updated: Oct 19
Picture this: your receive a call out of the blue, and it has just enough information for you to pay attention.
The caller will commonly know your business name, have basic business details, use technical language, and claim to be from a well-known software company, internet provider, bank, or security team. Then comes the warning: there is a problem with a computer, device, email account, payment system, or network.
The problem is fake. The support is fake. The goal is real: to get you or your staff to click a harmful link, download dangerous software, share login details, or hand over remote access.
Example: "Hi I am Sarah, calling from Sage/Xero/Intuit and there is an issue with your MTD upload. There is a system error your end, what operating system are you running the software on? This needs an upgrade driver to run smoothly. Are you able to run a link I will send you directly? Are you able to let me take access to your screen and I will help you install the driver easily?"
Small businesses are common targets because staff are busy, systems are often shared, there is no real IT support and one rushed decision can open the door to fraud.
The scam usually starts with urgency
IT support scams rarely begin with a calm explanation. They create pressure.
A caller, email, pop-up, or text message may claim that:
A virus has been found on a computer.
An email account has been compromised.
A cloud storage account will be suspended.
A payment service has detected suspicious activity.
A device is sending error messages.
A software licence has expired/not working correctly and must be renewed at once.
The message often says action must be taken immediately. That pressure is the first warning sign. Real IT teams, banks, and technology providers do not need panic to solve a problem.
Scammers use urgency because it stops people checking. They want the target to act before asking a colleague, calling a known supplier, or looking at the account directly.
Watch for these warning signs
A scammer may be friendly, confident, or even patient. The tone is not always aggressive. Look at the behaviour instead.
Common red flags include:
Unexpected contact
The person reaches out first and claims there is a serious technical issue. This is the first you are aware of the situation.
Requests for remote access
They ask to control a computer using remote access software. These tools can be legitimate, but criminals use them to search files, install malware, or approve payments.
Links to “fix” the issue
They send a link by email, chat, or text and ask someone to log in or download a file.
Requests for codes
They ask for multi-factor authentication codes, password reset links, or one-time passcodes.
Payment demands
They ask for card details, bank transfers, gift cards, or cryptocurrency to renew support, remove a virus, or unlock an account.
If someone contacts the business first and asks for passwords, codes, downloads, payments, or remote access, treat it as suspicious until proven otherwise.
Know the common tricks scammers use
Fraudsters often copy the habits of genuine support teams. That makes these scams harder to spot.
They may use spoofed phone numbers, so the caller ID appears familiar. They may send emails that look like service alerts. They may use terms such as “firewall”, “licence key”, “account verification”, or “security certificate” to sound credible.
Pop-up scams are common too. A browser window may show a loud warning, sometimes with an alarm sound, telling the user not to close the page. It may display a phone number for “support”. Closing the browser, restarting the device, or asking a trusted IT contact is safer than calling that number.
Check before you act
The safest habit is simple: pause, verify, then respond.
Do not use the phone number, email link, or contact details provided in the suspicious message. Instead, use a known route:
If the claim is about | Check it by using |
A software account | The official app or website typed into the browser |
A bank or payment service | The number on the back of the card or the provider’s website |
Broadband or phone service | The supplier’s official customer support page |
A work device | A trusted IT provider or internal contact |
An email account | The account security page reached directly |
If the caller says they are from an existing IT supplier, end the call and ring back using the number already held in company records. A genuine supplier will understand this is verification.
Do not worry about seeming rude. A short sentence is enough:
“I need to verify this call. I’ll contact our provider directly, thank you for your call.”
Set simple rules for the whole business
Small businesses do not need complex security policies to reduce risk. Clear rules help staff make safe choices when under pressure.
Put these rules where people can see them:
No one should give out passwords, reset links, or login codes.
No one should install software after an unexpected call or message.
No one should grant remote access unless the request has been verified.
Payments for IT support must follow the usual approval process.
Suspicious messages should be reported, not ignored.
It also helps to decide who can approve remote access. If only one or two named people can do this, scammers have fewer chances.
Use multi-factor authentication where possible, but remind staff that codes are private. A real support agent should not ask to be told a login code.
The best defence is a pause
Scammers win when routine work turns into rushed action. They pretend to be technical support agents, invent fake problems, and offer help that leads to harmful links, dangerous downloads, stolen credentials, or remote access.
The strongest habit is to slow the moment down.
Verify through a trusted channel.
Ask a second person.
Refuse unexpected requests for passwords, codes, software installs, payments, or device control.
A real technical issue can wait a few minutes.
Here is what happened when Kent Brushes fell foul of a sophisticated unauthorised push payment scam which resulted in £1.6 million lost to scammers in 20 minutes. The hairbrush company, suppliers of brushes to the Royal Family, lost their money in a very short space of time, and three months later, they have not been able to claim any of their funds back.
Scammers telephoned the financial controller (FC) using a person of authority and convinced him the company's money was at risk and that it needed to be transferred. They copied the companies website and number.
The FC was requested to log into his account to move the funds somewhere else. He went onto the website and logged into what he thought was his account, the screen went blank. The FC assumed his computer was completing updates, yet this is how scammers were able to gain access to the Kent Brushes banking account. Money was sifted through nearly 40 separate transactions, all to new payees in less than 20 minutes. Whilst this story is a few years old it drastically demonstrates how easy it is to fall foul of these scams. This cold call can sound incredibly convincing.
Comments