Tech support calls and AI voice clones: phone scams

How to handle fake support calls and cloned voices

If a call, a pop-up, or a voice message asks you to install software, give remote access, read out a code, or move money, hang up. Then contact the company or the person on a number you find yourself, from their website, your contract, or your contacts. This rule covers both of the phone scams in this guide, and it is the phone version of recognizing a fake message. Microsoft states the principle for its own support in its guidance on tech support scams: any communication with Microsoft has to be initiated by you.

Fake technical support

The script is old and still effective. A pop-up says your computer is infected and shows a number to call, or someone calls claiming to be from Microsoft, your internet provider, or “the security team.” They ask you to install a remote access tool, then find a “problem,” charge for the fix, or move on to your bank account.

What the real companies say:

• Microsoft does not send unsolicited emails or make unsolicited calls to request personal information or fix your computer, and its real error messages never include phone numbers.
• The FTC says real security pop-ups and messages will never ask you to call a number.
• The FBI notes that companies generally do not contact you to ask for your username, password, or one-time code.

The scale is large. The FBI’s IC3 recorded 47,794 tech support scam complaints in 2025, with reported losses of $2.13 billion, the third costliest type of fraud it tracks. Microsoft reported blocking an average of 4,415 suspicious connections to its Quick Assist remote help tool every day between April 2024 and April 2025.

If you already let someone in, Microsoft’s advice is to uninstall the remote access tool, run a full security scan, change your passwords, and contact your bank.

Fake bank and account security calls

A variant targets your bank account directly: a caller poses as your bank’s fraud team or as technical support and asks for the code you just received, to “cancel a transaction.” In November 2025, the FBI reported more than 5,100 such complaints since January 2025, with over $262 million lost. The code is the key to your account: no genuine bank or support agent needs it.

Cloned voices

AI can now imitate a voice from a short recording. Australia’s Scamwatch says a few seconds of a voice recording can be enough, and the FTC warns that scammers can take the clip from content posted online. The uses documented by the authorities include:

• a relative in distress who needs money right away, the case the FTC warned about in 2023;
• a senior official or executive, in campaigns the FBI described in 2025, often moving quickly to Signal, Telegram, or WhatsApp;
• a business leader confirming a transfer, which the FBI counts among BEC scams involving AI.

So far, cloned voices account for a small share of reported losses: the FBI’s 2025 report counted over $5 million in distress scams using voice cloning. But they defeat the most natural check of all, recognizing a voice. Canada’s Cyber Centre puts it plainly in its guidance on voice phishing: hang up and call back on a public number, never the number provided by the caller or your phone’s callback option.

Rules for a small team

1. Callback rule. No payment, change of bank details, or password reset on the strength of a call alone; call back on a known number.
2. A code word. The FBI suggests a secret word or phrase within a family; the same works for a small business, for payment requests from the owner.
3. No remote access for unexpected callers. Real support sessions are ones you asked for, with a tool you or your IT provider chose.
4. Never share a code. The FBI’s advice is blunt: never give a two-factor code to anyone, by text, email, phone, or messaging app.
5. Caller ID proves nothing. Canadian authorities warn that names and numbers shown on screen can be spoofed.

The legal side, in the US

Since April 1, 2024, the FTC’s rule against impersonating government agencies and businesses lets it seek penalties and refunds from scammers who pose as a company or its employees. As of October 1, 2026, a proposed extension to the impersonation of individuals, such as a cloned relative, had not been adopted.

Reporting a phone scam

Report the number and what was said, even if you lost nothing. See where to report a scam in your country.

When the voice is the boss’s

A cloned voice asking for an urgent transfer is a form of CEO fraud. Read how business email compromise and CEO fraud work to set the right payment rules.