December 22, 2021 By David Bisson 2 min read

Got a pop-up message from tech support? It’s probably not the real thing. Tech support scams were the top phishing threat for organizations in the third quarter of 2021, reported NortonLifeLock.

Tech support scam takeaways

The consumer antivirus company reported that it blocked over 12.3 million tech support URLs connected with scam attempts between July and September. At this volume, tech support scams served as the top phishing threat during that period.

Those numbers weren’t a surprise. For instance, Microsoft noted that, while the numbers of this kind of scam reported to them generally fell since 2018, 60% of consumers faced a tech support scam between July 2020 and July 2021. One in six of those people fell for the ruse. In response, 30% of victims suffered computer problems. This was followed by compromised passwords and fraudulent use of payment cards at 23% and 18%, respectively.

Out of all the age groups surveyed, millennials and Gen Zers experienced the greatest exposure to tech support phishing scams. One-tenth of respondents from both age groups fell for the ploy, losing money in the process.

Why tech support scams are more pertinent than ever

According to NortonLifeLock, tech support phishing scams became more pervasive following the events of 2020 for two reasons. First, users became more reliant on computers, smartphones and other devices to do their work, go to school, get their groceries and complete other daily tasks. Malicious actors took advantage of this increased use with the knowledge that they could expand their base of potential victims.

Second, tech support scams have a history of working. Why? Like other types of phishing, they rely on social engineering first and foremost. This lowers the barrier of entry for many digital attackers, as a lack of technical expertise doesn’t prohibit them from targeting someone.

These tech support scams claim all different types of people as victims. Young people, the elderly and even people who track down scammers on the web can fall for it. That’s what happened to the creator of the Tech Support Scams YouTube channel in July. Scammers contacted the YouTube creator while pretending to be support representatives for the platform. Those attackers didn’t steal the creator’s account credentials, wrote The Register, but they did manage to trick him into at least temporarily deleting his channel.

How to defend against tech support scams

For organizations to defend themselves against tech support phishing scams, they need to invest in their employee security awareness training programs.

NortonLifeLock recommended that organizations educate their employees to never call a number contained in a pop-up ad or message warning of computer issues. Through their employer’s security modules, they can learn to inform IT and/or to contact the tech company being impersonated instead.

At the same time, security firms can use threat intelligence to keep their employees informed about relevant scam attempts. This is especially pertinent around the holidays when the security community witnesses a rise in shopping fraud attempts and charity phishing scams.

More from News

Hackers are increasingly targeting auto dealers

3 min read - Update as of July 11, 2024 In late June, more than 15,000 car dealerships across North America were affected by a cyberattack on CDK Global, which provides software to car dealers. After two cyberattacks over two days, CDK shut down all systems, which caused delays for car buyers and disruptions for the dealerships. Many dealerships went back to manual processes, including handwriting up orders, so that sales could continue at a slower pace. Car buyers who recently bought a car from…

CISA director says banning ransomware payments is off the table

3 min read - The FBI, CISA and NSA all strongly advise against organizations making ransomware payments if they fall victim to ransomware attacks. If so, why not place a ban on paying ransomware demands? The topic came up at a recent Oxford Cyber Forum. Jen Easterly, Director of CISA, commented on the issue, saying, “I think within our system in the U.S. — just from a practical perspective — I don’t see it happening.” It’s unlikely this was a purely spontaneous remark as the…

A proactive cybersecurity policy is not just smart — it’s essential

3 min read - It’s easy to focus on the “after” when it comes to cybersecurity: How to stop an attack after it begins and how to recover when it's over. But while a reactive response sort of worked in the past, it simply is not good enough in today’s world. Not only are attacks more intense and more damaging than ever before, but cyber criminals also use so many different attack methods. Zscaler ThreatLabz 2024 Phishing Report found that phishing attacks increased by…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today