How to identify a valid MS agent trying to download Ultrviewer

Question

My Surface suddenly gave an alert that my computer may be comprised and gave a number to call - 855-8496582. The person who answered claimed to be a MS employee - Jason White ID MS21672 - and wanted me to download an app - Ultraviewer - in order to see the problem. I started the process of downloading but decided not to continue until verifying if this was legitimate. Now I cannot operate my Surface and not sure what to do next.

Answer 1

This is a classic tech support scam and not a legitimate Microsoft support interaction.

Key points from the scenario:

• Real Microsoft error or warning messages never include a phone number to call.
• Microsoft does not make unsolicited support calls or ask customers to call random phone numbers shown in pop‑ups.
• Scammers commonly ask victims to install remote‑access tools (such as UltraViewer) so they can “inspect” or “fix” the device; this is a known scam pattern.

What to do now on the Surface:

1. Close the fake alert and browser
   • If the browser is still open or the screen looks “locked”, press Ctrl+Alt+Del and open Task Manager, then end all browser processes (for example, Microsoft Edge, Chrome, etc.).
   • If that does not work, restart the Surface using the power button.
2. Do not call that number again and do not install UltraViewer
   • Treat that number and any similar pop‑up numbers as malicious.
   • Do not provide any personal, financial, or sign‑in information to anyone who contacts using that number.
3. Check whether anything was installed or changed
   • If the UltraViewer installation was not completed and no remote access was granted, the device is likely not compromised by that tool.
   • After restart, go to Settings → Apps and uninstall anything that was installed as part of this interaction, if present.
4. Scan the device for malware
   • Run a full scan with Microsoft Defender Antivirus and install all available security updates.
5. Change passwords and monitor accounts (if any access was granted)
   • If at any point remote access was allowed, or credentials were shared, change passwords for important accounts and monitor sign‑in activity and financial accounts for unusual activity.
6. Report the scam to Microsoft
   • Submit details (phone number, what was shown on screen, what was requested) at https://www.microsoft.com/reportascam so Microsoft can investigate.
   • If there was any financial loss, also contact the bank or card issuer and consider notifying local law enforcement.

How to recognize valid Microsoft support in the future:

• Any contact with Microsoft support must be initiated by the customer through official channels (for example, the Microsoft Support site or built‑in Get Help app).
• Microsoft will never:
  • Display a phone number in an error or warning dialog and ask to call it.
  • Cold‑call to say a device is infected.
  • Ask to pay for support with cryptocurrency or gift cards.
• Use Microsoft Edge with Microsoft Defender SmartScreen enabled to help block known support‑scam sites and pop‑up loops.

---

References:

• Protect yourself from tech support scams
• Tech support scams
• Protect yourself from online scams and attacks
• Microsoft Defender Scam or Do I have a virus on my computer - Microsoft Q&A
• Who do I call for support? - Microsoft Q&A