{"id":154,"date":"2026-07-01T11:51:12","date_gmt":"2026-07-01T11:51:12","guid":{"rendered":"https:\/\/www.tractivesolutions.com\/uk\/uncategorized\/beware-of-the-scam\/"},"modified":"2026-07-01T12:51:35","modified_gmt":"2026-07-01T12:51:35","slug":"beware-of-the-scam","status":"publish","type":"post","link":"https:\/\/www.tractivesolutions.com\/uk\/uncategorized\/beware-of-the-scam\/","title":{"rendered":"Beware of the Scam"},"content":{"rendered":"<style>.ts-article-shell{--ts-black:#0d0b10;--ts-purple:#A20080;--ts-orange:#f28c28;--ts-white:#f7f4fb;--ts-muted:#f0d9ea;font-family:Arimo,Arial,sans-serif;color:var(--ts-white);background:var(--ts-purple);padding:28px 0;margin:0}.ts-article-core{background:var(--ts-black);max-width:1180px;margin:0 auto;border-radius:24px;box-shadow:0 18px 50px rgba(0,0,0,.28);overflow:hidden}.ts-article-inner{padding:48px 28px}.ts-article-inner h1,.ts-article-inner h2,.ts-article-inner h3,.ts-article-inner h4{font-family:Righteous,Arimo,Arial,sans-serif;color:var(--ts-orange);line-height:1.18}.ts-article-inner h1{font-size:42px}.ts-article-inner h2{font-size:30px}.ts-article-inner h3{font-size:24px}.ts-article-inner p,.ts-article-inner li,.ts-article-inner blockquote{font-size:18px;line-height:1.8;color:#fff}.ts-article-inner a{color:#f28c28}.ts-article-inner ul,.ts-article-inner ol{padding-left:24px}.ts-article-inner img{max-width:100%;height:auto;border-radius:14px}.ts-article-inner table{width:100%;border-collapse:collapse;margin:24px 0}.ts-article-inner td,.ts-article-inner th{border:1px solid rgba(255,255,255,.18);padding:10px;color:#fff}.ts-article-inner blockquote{margin:24px 0;padding:18px 20px;border-left:4px solid var(--ts-orange);background:rgba(255,255,255,.05);border-radius:12px}.ts-article-inner hr{border:none;border-top:1px solid rgba(255,255,255,.16);margin:30px 0}<\/style><div class=\"ts-article-shell\"><div class=\"ts-article-core\"><div class=\"ts-article-inner\">\r\n<div class=\"ttr_post_content_inner\">\r\n<div class=\"ttr_post_inner_box\">\r\n<h2 class=\"ttr_post_title\">\r\n\r\nBeware of the Scam\r\n<\/h2>\r\n<span property=\"dc:title\" content=\"Beware of the Scam\" class=\"rdf-meta element-hidden\"><\/span><span property=\"sioc:num_replies\" content=\"0\" datatype=\"xsd:integer\" class=\"rdf-meta element-hidden\"><\/span><\/div>\r\n<div class=\"ttr_article\">\r\n<div  class=\"postcontent\">\r\n<div class=\"field field-name-field-image field-type-image field-label-hidden\"><div class=\"field-items\"><div class=\"field-item even\" rel=\"og:image rdfs:seeAlso\" resource=\"https:\/\/www.tractivesolutions.com\/uk\/wp-content\/uploads\/2026\/07\/BewareScam2.jpg\"><img loading=\"lazy\" decoding=\"async\" typeof=\"foaf:Image\" src=\"https:\/\/www.tractivesolutions.com\/uk\/wp-content\/uploads\/2026\/07\/BewareScam2.jpg\" width=\"480\" height=\"421\" alt=\"\" \/><\/div><\/div><\/div><div class=\"field field-name-body field-type-text-with-summary field-label-hidden\"><div class=\"field-items\"><div class=\"field-item even\" property=\"content:encoded\"><p><br \/>The scary world of Fake Support Calls<br \/><br \/>\n<\/p><p>We are sure you have received one of these calls.  Someone calling your phone saying they have spotted unauthorised people using your internet and it could be a &#8220;virus&#8221; or someone using your internet without your permission.  Now these can be real but most likely a scam to try and gain remote access to your machine.  So this article is about how to spot the fake from the genuine.<br \/><br \/>\nSo just to give you context we have experienced these calls for a while but we finally managed to run through the script used, trying to convince you there are issues with your computer.  From doing this we can now expose the things to look out for and the ways they try to confuse you into obtaining access to your computer.  We did not let them connect so what they do after this point we are unsure, however we can be sure that it will be to do harm to your machine.  Most likely install a crypto virus (To be covered in future articles) to encrypt your files and demand payment to unlock.<br \/><br \/>\nHow to spot the scam.<br \/><br \/>\nFirstly, they will NOT know your details by name.  If you challenge them on this, they will either hang up or say for security reason they cannot confirm this.  This obviously is wrong, if they called you they would be able to confirm this if they were genuine.  Do not let this be the only criteria however as this may be known to a scammer if they have managed to buy a directory listing with names and numbers.<br \/><br \/>\nThe second thing they will do is ask you what the button is next to the CTRL key.  This allows them to work out if you are using a MAC or a PC.  Our example will be for a Windows version however we are sure the same approach will be used if on a MAC.  They will request to press the Windows and the R key together.  This will open a Run box.  Then to request you to type cmd.  This is a fairly common tool for IP professionals to use as this will open a Command Prompt window.  This is something that you will no doubt have seen before in your time.  Over the many calls we have received there are a couple of commands that have been used to scare users.  Here are the ones we know they use however we are sure there are more.  Below are a couple of the commands used and what there are actually telling you against what they say they mean.<br \/><br \/>\n<\/p><p><b>Command<\/b> &#8211; Assoc<br \/>\n<img decoding=\"async\" src=\"https:\/\/www.tractivesolutions.com\/OldSite\/images\/articles\/ScamBeware\/1.jpg\" width=\"40%\" \/><br \/>\nScammer \u2013 This is showing the connections to files on your computer.<br \/>\nActual command \u2013 This command is used to show the files and the associated program with this file type.  This is normal.<br \/>\n<br \/><br \/>\n<\/p><p><b>Command<\/b>  &#8211; Netstat<br \/>\n<img decoding=\"async\" src=\"https:\/\/www.tractivesolutions.com\/OldSite\/images\/articles\/ScamBeware\/2.jpg\" width=\"40%\" \/><br \/>\nScammer \u2013 This is showing all the active connections on your computer from foreign addresses.  We need to sort this issue now as you are hugely at risk from all these unwanted connections.<br \/>\nActual command \u2013 This shows the connections your machine has with your network.  This will show all connections in and out of your machine.  This is a common list and although can show unwanted connections, it is likely this is only used to scare you.  Your machine will have many of these by default as this is how it communicates internally and externally on the network.<br \/>\n<\/p><p><br \/>\nThese commands are used purely to scare you to going to a web address.  The next command they will ask you to do will be to go to a website.  Type <a href=\"http:\/\/www.bit.do\/######\">www.bit.do\/######<\/a> I am sure there are many versions of this used hence the #####.  <a href=\"http:\/\/www.bit.do\">www.bit.do<\/a> is a url masking site and allows the scammer to hide behind a short web address.  Others could be <a href=\"http:\/\/www.tinyurl.com\">www.tinyurl.com<\/a>, <a href=\"http:\/\/www.tiny.cc\">www.tiny.cc<\/a>, <a href=\"http:\/\/www.is.gd\">www.is.gd<\/a> and <a href=\"http:\/\/www.soo.gd\">www.soo.gd<\/a> this list is not an exclusive list however these are most of the free services offering the same features, these are expressed just for example.<br \/><br \/>\nWhen these links are followed you will be prompted to download a teamviewer application (or other remote access tool).  Now these are not bad programs and you may have used them before.  This is one of many different remote access tools, this one happens however to be free for personal use.  This will show a Personal ID and Password which they will request you give them.  This is where we stopped our investigation and I would advise you never take it this far.  This is the point that the scammer will gain entry to your machine and &#8220;technically&#8221; with your permission.<br \/><br \/>\nPlease don\u2019t take this as a request not to use tools such as teamviewer, these are powerful support tools and will assist support agents to fix problems.  The difference should be that this is done at your request and not at theirs.  Support agents will not use the above scare tactics to convince you to let them to remote connect.<br \/><br \/>\n<\/p><p><br \/>\nTractive Solutions wishes a safe and secure environment for all.<br \/><br \/>\n<\/p><p>If you wish to have advise on situations detailed in this article please don&#8217;t hesitate to contact us.<\/p><p><\/p>\n<\/div><\/div><\/div> \r\n<div style=\"clear:both;\"><\/div>\r\n<div class=\"links\"><ul class=\"links inline\"><li class=\"comment_forbidden first last\"><span>Log in to post comments<\/span><\/li>\n<\/ul><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>Beware of the Scam The scary world of Fake Support Calls We are sure you have received one of these calls. Someone calling your phone saying they have spotted unauthorised people using your internet and it could be a &#8220;virus&#8221; or someone using your internet without your permission. Now these can be real but most [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-154","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/posts\/154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/comments?post=154"}],"version-history":[{"count":3,"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/posts\/154\/revisions"}],"predecessor-version":[{"id":174,"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/posts\/154\/revisions\/174"}],"wp:attachment":[{"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/media?parent=154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/categories?post=154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tractivesolutions.com\/uk\/wp-json\/wp\/v2\/tags?post=154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}