Summary

This guide helps you troubleshoot and resolve: How to Spot Fake CrowdStrike IT Support and Microsoft Outage Recovery Scam Calls Targeting Australian Businesses. Follow the steps below to fix the issue.

Common Causes

How to Spot Fake CrowdStrike IT Support and Microsoft Outage Recovery Scam Calls Targeting Australian Businesses

Following global technology outages, scammers often impersonate security vendors like CrowdStrike or Microsoft to target Australian small businesses. These fraudulent calls claim your systems are compromised and attempt to steal login credentials, install remote access software, or charge for unnecessary repairs. This guide helps you identify these scams and protect your organisation.

Recognising the Scam

Fraudulent support calls typically share several warning signs. Understanding these patterns helps you respond safely before any damage occurs.

Common Scam Tactics

• Claiming to be from CrowdStrike, Microsoft, or another major technology vendor
• Referencing a recent global outage or security breach to create urgency
• Stating your computer is sending errors or is infected with malware
• Requesting remote access to your device using tools such as AnyDesk, TeamViewer, or QuickSupport
• Asking for usernames, passwords, or multi-factor authentication codes
• Demanding payment via gift cards, cryptocurrency, or wire transfer
• Using pressure tactics and threatening that your data will be lost if you do not act immediately

What Legitimate Vendors Will Not Do

• Microsoft, CrowdStrike, and your IT provider will never call you unprompted to report a virus or outage
• Legitimate support will never ask for your password or MFA code over the phone
• Vendors do not request payment by gift card or cryptocurrency
• Genuine technicians do not pressure you to install remote access software during an unsolicited call

Immediate Actions

1. Hang up immediately if you receive an unsolicited call claiming to be from CrowdStrike, Microsoft, or your IT provider.
2. Do not provide any personal information, usernames, passwords, or authentication codes.
3. Do not install remote access software at the caller's request.
4. Do not make any payments or share financial details.
5. Note the caller's phone number and any details they provided, then end the call.
6. Contact your IT provider directly using a phone number or email address you already trust.
7. Open a ticket at Open a Ticket if you are unsure whether a call was legitimate.

Detailed Instructions

Verifying a Support Call

1. Ask the caller for their name, organisation, and a reference number.
2. Tell them you will call back using an official number from your existing records.
3. End the call without providing any system access or credentials.
4. Check your previous correspondence with your IT provider or the vendor in question for a verified contact number.
5. Call that number directly and ask whether they attempted to contact you.

If You Already Granted Remote Access

1. Disconnect the affected device from the internet immediately by unplugging the Ethernet cable or turning off Wi-Fi.
2. Shut down the computer completely.
3. Contact your IT provider using a different device to open a ticket at Open a Ticket.
4. Change passwords for any accounts accessed on the compromised device, including email, banking, and business applications.
5. Review your multi-factor authentication settings and remove any unfamiliar devices or trusted browsers.
6. Have a qualified technician scan the device for malware before reconnecting it to your network.

If You Shared Credentials or Payment Details

1. Change the affected passwords immediately from a trusted device.
2. Enable multi-factor authentication where available.
3. Contact your bank or card provider if you shared financial information.
4. Report the incident to Scamwatch via the Australian Competition and Consumer Commission.
5. Open a ticket at Open a Ticket so your IT provider can assist with securing your business environment.

Protecting Your Business

• Train all staff to recognise unsolicited tech support calls and to hang up on unexpected callers claiming to be from vendors.
• Establish a clear policy that only authorised internal IT staff or your verified MSP may provide remote support.
• Use multi-factor authentication on all business email and critical accounts.
• Keep operating systems and security software updated through official channels only.
• Encourage staff to verify any suspicious communication by contacting your IT provider directly.

Still Having Issues?