December 22, 2021 By David Bisson 2 min read

Got a pop-up message from tech support? It’s probably not the real thing. Tech support scams were the top phishing threat for organizations in the third quarter of 2021, reported NortonLifeLock.

Tech support scam takeaways

The consumer antivirus company reported that it blocked over 12.3 million tech support URLs connected with scam attempts between July and September. At this volume, tech support scams served as the top phishing threat during that period.

Those numbers weren’t a surprise. For instance, Microsoft noted that, while the numbers of this kind of scam reported to them generally fell since 2018, 60% of consumers faced a tech support scam between July 2020 and July 2021. One in six of those people fell for the ruse. In response, 30% of victims suffered computer problems. This was followed by compromised passwords and fraudulent use of payment cards at 23% and 18%, respectively.

Out of all the age groups surveyed, millennials and Gen Zers experienced the greatest exposure to tech support phishing scams. One-tenth of respondents from both age groups fell for the ploy, losing money in the process.

Why tech support scams are more pertinent than ever

According to NortonLifeLock, tech support phishing scams became more pervasive following the events of 2020 for two reasons. First, users became more reliant on computers, smartphones and other devices to do their work, go to school, get their groceries and complete other daily tasks. Malicious actors took advantage of this increased use with the knowledge that they could expand their base of potential victims.

Second, tech support scams have a history of working. Why? Like other types of phishing, they rely on social engineering first and foremost. This lowers the barrier of entry for many digital attackers, as a lack of technical expertise doesn’t prohibit them from targeting someone.

These tech support scams claim all different types of people as victims. Young people, the elderly and even people who track down scammers on the web can fall for it. That’s what happened to the creator of the Tech Support Scams YouTube channel in July. Scammers contacted the YouTube creator while pretending to be support representatives for the platform. Those attackers didn’t steal the creator’s account credentials, wrote The Register, but they did manage to trick him into at least temporarily deleting his channel.

How to defend against tech support scams

For organizations to defend themselves against tech support phishing scams, they need to invest in their employee security awareness training programs.

NortonLifeLock recommended that organizations educate their employees to never call a number contained in a pop-up ad or message warning of computer issues. Through their employer’s security modules, they can learn to inform IT and/or to contact the tech company being impersonated instead.

At the same time, security firms can use threat intelligence to keep their employees informed about relevant scam attempts. This is especially pertinent around the holidays when the security community witnesses a rise in shopping fraud attempts and charity phishing scams.

More from News

What is the Open-Source Software Security Initiative (OS3I)?

3 min read - The Open-Source Software Security Initiative (OS3I) recently released Securing the Open-Source Software Ecosystem report, which details the members’ current priorities and recommended cybersecurity solutions. The accompanying fact sheet also provides the highlights of the report. The OS3I includes both federal departments and agencies working together to deliver policy solutions to secure and defend the ecosystem. The new initiative is part of the overall National Cybersecurity Strategy. After the Log4Shell vulnerability in 2021, the Biden-Harris administration committed to improving the security…

Europe’s Cyber Resilience Act: Redefining open source

3 min read - Amid an increasingly complex threat landscape, we find ourselves at a crossroads where law, technology and community converge. As such, cyber resilience is more crucial than ever. At its heart, cyber resilience means maintaining a robust security posture despite adverse cyber events and being able to anticipate, withstand, recover from and adapt to such incidents. While new data privacy and protection regulations like GDPR, HIPAA and CCPA are being introduced more frequently than ever, did you know that there is new…

Feds release urgent guidance for U.S. water sector

3 min read - The water and wastewater sector (WWS) faces cybersecurity challenges that leave it wide open to attacks. In response, the CISA, EPA and FBI recently released joint guidance to the sector, citing variable cyber maturity levels and potential cybersecurity solutions. The new Incident Response Guide (IRG) provides the water sector with information about the federal roles, resources and responsibilities for each stage of the cyber incident response lifecycle. Sector owners and operators can use this information to augment their incident response…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today