A caller claims to be from the NCSC and says your device has been compromised
Scammers cold-call posing as NCSC (UK cybersecurity agency) officials, claiming your device is compromised. They ask you to install AnyDesk or TeamViewer for remote access. The NCSC never cold-calls individuals about security issues.
Also known as: fake NCSC call UK, National Cyber Security Centre phone scam, NCSC impersonation scam UK, fake cybersecurity official cold call UK, government cyber security impersonation call UK
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 Hang up immediately. The NCSC does not cold-call members of the public about security threats on their devices.
- 2 Never install remote-access software (AnyDesk, TeamViewer, Quick Support) at the request of an unsolicited caller — no legitimate government agency will ask this.
- 3 Do not share one-time passcodes, online banking passwords, or personal information with the caller.
- 4 If you want to verify whether a contact is genuine, use the NCSC's official 'Verify an NCSC contact' service at https://www.ncsc.gov.uk.
- 5 If you already installed remote-access software: disconnect from the internet, uninstall AnyDesk/TeamViewer/Quick Support, then run a full antivirus scan.
- 6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 7 If you disclosed banking details or logged in to online banking while the caller had remote access, call your bank immediately.
- 8 Change all passwords from a separate, clean device — never the one they accessed.
- 9 Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ An unexpected call claims to be from the NCSC (National Cyber Security Centre) — the NCSC does not cold-call individuals about security issues
- ⚠ The caller says your device, router, or accounts have been compromised and they need to 'fix it remotely'
- ⚠ You are asked to install AnyDesk, TeamViewer, Quick Support, or similar software so the 'technician' can access your device
- ⚠ The caller knows your name or some personal details — this is to build trust, not a sign they are legitimate
- ⚠ You are asked for one-time passcodes, banking credentials, or to log in to online banking while they watch
- ⚠ The caller uses urgency: 'your accounts will be frozen' or 'criminal activity is underway on your device right now'
- ⚠ The caller ID shows an NCSC or government number — scammers can spoof any number