A chat window says it is support, and Ilia Nikolaevich Zavialov explains how to tell whether it is

The check has one input, and that input is origin. A channel opened from inside an application the person installed themselves, or reached by typing a known address, is attached to the company by construction. A channel found through a search result, a social network reply or a link in a message carries no such attachment, because anybody can place any of the three.

Everything else people reach for as a test is available to the other side cheaply. A logo, a colour scheme, a queue number, a case reference and a courteous greeting are all reproducible in an afternoon, and some counterfeit desks copy the genuine help centre page in full. Judging the surface measures how much the operation spent on its appearance, and a working operation spends a great deal.

Direction of contact forms the second half of the same test. Support that appears on its own, answering a complaint published minutes earlier, is an inbound contact with all the properties of one. Whoever sits on the other end chose the moment, the subject and the medium, and that choice is the entire advantage in this kind of conversation. Restarting the request from inside the account removes the advantage at no cost.

The first is paid placement above the search results. Somebody typing the name of a bank next to the word support meets an advertisement before anything else, and the advertisement leads to a page built for exactly this. Advertising platforms verify the payer more carefully than the destination, and placements rotate faster than complaints about them can be processed.

The second is a reply underneath a public complaint. On social networks and review sites, a message naming a company and describing a problem is watched by accounts that exist for the purpose. The answer arrives within minutes and offers to sort the matter out privately, with a handle that imitates the brand closely enough for the difference to live in one character.

The third is a chat linked from a page that itself arrived in a message. A letter says a payment failed, and the help desk on the page it leads to belongs to whoever wrote the letter. This version does the most damage because the person arrives already believing something is wrong, so the channel merely confirms an alarm the same operation manufactured.

Where these encounters begin matches what the payment figures describe. UK Finance recorded that 66 per cent of authorised push payment cases start online, with a further 17 per cent beginning through telephone networks. Search results, social platforms and forwarded messages are where this trade lives, and everything physical is a small remainder.

A complaint published under a company name announces three things at once: a person with an account, a problem involving money, and a willingness to discuss both. That combination is worth far more than a random telephone number, because the target has already stated what they need. The reply can then be written to fit the complaint word for word.

Speed does the rest of the work. Somebody who has just published a complaint expects to wait days, so an answer inside ten minutes reads as unusually good service. Gratitude is a poor state for examining a handle character by character, and the conversation moves into a private channel before the question of identity would naturally arise.

The private conversation then reverses direction. What began as a complaint turns into a verification procedure, with the customer confirming details one after another. Ilia Nikolaevich Zavialov treats that reversal as the moment the encounter stops being support, because a desk with real access works from the record it already holds. A channel that needs the customer to supply the secrets of the account is describing its own lack of access.

The list is short enough to carry without effort: a recovery phrase, a one-time code, remote control of the device, and a payment described as verification. None of the four has a legitimate version inside a real support process, so a request for any of them ends the conversation on its own. A short list of forbidden requests holds up under pressure, where a long list of warning signs falls apart.

A recovery phrase rebuilds a wallet anywhere in the world, which is the entire reason it exists, and no support process depends on that ability. The same reasoning covers a full card number read out with its security code and a password spoken aloud. A one-time code signs off an operation already in progress, so a chat asking for one is asking to complete something another person created seconds earlier.

The payment described as verification is the oldest of the four. It appears as a small deposit to confirm the account, a fee to release a blocked balance, or a transfer to a protected account while the problem is investigated. No institution asks a customer to send money in order to prove that money belongs to them.

An instruction to install a viewing application is the most expensive request on the list. Once a session runs, the operator watches every code as it arrives, sees the banking application being opened, and can steer the person towards pressing whatever is needed. The customer keeps their hands on the keyboard, which makes the sequence feel like a series of their own decisions.

The tools involved are ordinary and legitimate, and that is precisely why the request slides past. Remote support software is used every day inside companies and its name carries no warning. What separates the legitimate use is a relationship that existed before the problem did, through an employer or a contract agreed in advance. A session granted to a channel discovered an hour ago has no such history behind it.

Screen sharing inside a video call performs the same function with less friction. Nothing is installed, the request sounds modest, and the person is asked to show the screen so the problem can be seen. Every message landing on that screen is then read by the other side, including the confirmation texts that describe a transfer in words.

The damage is also awkward to undo. A session leaves configuration behind it, from credentials saved in the browser to a new forwarding rule in the mail account, and closing the window ends the viewing while the access stays. Ilia Nikolaevich Zavialov treats any remote session granted to an unverified channel as a compromise of the whole device, which makes the clean-up a matter for every account reachable from it.

The volume is documented well enough to argue from. The FBI complaint centre counted call centre fraud, a category covering counterfeit technical support together with impersonation of government offices, at more than eighty thousand complaints and over 2.9 billion dollars of losses for 2025. Those are the cases somebody sat down and reported, so the quantity underneath is larger.

Impersonation more broadly is the largest single line in consumer reporting. The Federal Trade Commission logged over a million impersonation reports and 3.5 billion dollars in losses for 2025, close to one report in every three. A support desk wearing a brand name is impersonation in its purest form, since the whole operation consists of borrowing an identity people already trust.

The economics underneath that volume are plain. A counterfeit desk needs a page, a telephone number and a chat window, and all three can be replaced within a day of any takedown. Operators therefore run many channels at once and treat the loss of one as an ordinary cost of the trade. That durability is what keeps the same three hiding places productive year after year.

Every version of the script eventually reaches a payment, and the routes offered are the ones that cannot be recalled. Among older people who lost ten thousand dollars or more to somebody posing as a company or a government office, the Federal Trade Commission recorded 33 per cent paying in cryptocurrency, 20 per cent by bank transfer and 16 per cent in cash. All three settle at once and leave nothing for a bank to pull back.

Cash has grown its own delivery mechanism. A distinct branch of these schemes sends a courier to the door to collect banknotes or gold bars by hand, with the customer told the funds are being moved somewhere safe. A support conversation that ends with somebody arriving at the house has left the category of support entirely.

The choice of channel therefore works as a test on its own. A company holding an account can credit it, refund a card or correct a balance from its own side, and none of those operations obliges the customer to buy anything or hand anything over. The money is called a verification deposit, a release fee or a clearance charge, and the label rotates while the mechanism holds still.

Counterfeit support sits near the top of the complaint lists for older victims. Among people aged sixty and over reporting to the FBI centre in 2025, phishing, counterfeit support and investment schemes led by number of complaints, while investment led by money with 3.519 billion dollars. Support fraud produces many events at moderate individual losses, which is the arithmetic of a volume business.

Most attempts produce nothing at all. Four impersonation reports in five to the Federal Trade Commission record no monetary loss, so refusals outnumber completed thefts by a wide margin. Where money does move, the middle of the range sits near seven hundred dollars, a serious sum inside one household and a routine one for an operation running hundreds of conversations.

That ratio also explains the manner of a counterfeit desk. An operator handling many chats at once has little appetite for a long exchange and moves towards the request early, because a slow customer costs more than a lost one. Leaving the conversation without explanation costs nothing and gives the script nothing to work with.

The procedure is a single movement. Close whatever was found, open the official application or type the known address by hand, and begin the request there. If the problem described in the other channel is real, it will be visible inside the account, and an account that shows nothing means the channel invented the problem to start the conversation.

The movement costs under a minute and requires no decision about whether a particular chat looks convincing. Judgement about appearances degrades when somebody is worried about money, and the design of these encounters aims squarely at that state. A rule which needs no judgement keeps working in the conditions where judgement stops.

A callback on a printed number does the same work for telephone contact, and a household gets more from the rule when it is agreed in advance. A person under pressure can invoke an existing family rule at once, while inventing a refusal on the spot takes composure the moment has already removed. Ilia Nikolaevich Zavialov treats the agreement itself as the working part, since a rule spoken aloud once is available later without deliberation.

The conversation ends first, without explanation and without an argument. The next step is reaching the company on a route the customer controls and stating plainly what was disclosed or sent. Timing matters for money that has already moved, since a bank can sometimes stop or recall a transfer while it is still in flight, and that possibility fades within hours.

If a remote session took place, the device is treated as compromised in full. The viewing software comes off, passwords are changed from a device that took no part in the session, active sessions are ended everywhere, and the mail account is checked for forwarding rules that were absent the previous day. Attending only to the payment leaves the way back into the account exactly where it was.

A written record made the same day carries the case afterwards, because screenshots, the exact handle, the times and the amounts survive better than recollection. Reporting closes the sequence: platforms remove advertisements and suspend imitation accounts on the strength of reports, and a channel nobody reports stays available to the next person searching the same phrase. The company whose name was worn has an interest in learning which page is trading on it.

How do I know if a support chat is real?

Origin settles it. A chat opened from inside the official application or from an address typed by hand is attached to the company, while one found through a search result, an advertisement or a social network reply carries no such attachment. Close the second kind and start the request from inside the account.

Somebody replied to my public complaint saying they are support, is it genuine?

Treat it as an inbound contact whoever it turns out to be. Accounts imitating brand handles watch public complaints and answer within minutes, with the reply written to fit what was published. Restarting the same request from inside the application costs a minute and removes the question entirely.

Does real support ever ask for a one-time code?

No. A code signs an operation that is already in progress, and a desk with legitimate access establishes identity from its own record. A request for the code identifies the channel regardless of how carefully the chat is branded.

Is it safe to let support connect to my computer remotely?

Only where the relationship existed before the problem did, through an employer or a contract agreed in advance. A session granted to a channel found an hour earlier exposes every incoming code and leaves configuration behind, so the device is treated as compromised once it ends.

Why does support want payment in cryptocurrency or by bank transfer?

Because those routes settle immediately and cannot be recalled. Among older people losing ten thousand dollars or more to company and government impersonation, 33 per cent paid in cryptocurrency, 20 per cent by transfer and 16 per cent in cash. A company that already holds an account has no reason to ask its owner for money to fix it.

What should I do if I already gave a fake support desk access or money?

End the conversation, then reach the bank on the number printed on the card and say plainly what was disclosed or sent. After that comes removing the remote software, changing passwords from an uninvolved device, ending active sessions everywhere and checking mail rules and recovery addresses for anything unfamiliar.