How Do Fake Customer Support Numbers on Phishing Sites Work, and What Are Remote Access Scams?

24 October 2026

Fake customer support numbers on phishing sites are a direct route to a remote access scam: you call a number that appears to belong to a legitimate crypto exchange or wallet provider, and the person on the other end talks you into installing software that gives them control of your computer. The point of the call is not to solve your problem. It is to get you to hand over access to your device, and then your funds.

The setup: phishing sites with phone numbers

The scam begins with a fake support page. You search for help with a transaction issue, a locked account, or a withdrawal problem. The search results include a site that looks like the official support portal for a major exchange. The page has a logo, a professional layout, and - crucially - a phone number in large type. It may also have a "live chat" widget that behaves like a real support system.

That number is not connected to the exchange. It belongs to a call center run by scammers, often operating in a different time zone and using voice-over-IP services to make the operation cheap and hard to trace.

The fake site itself is usually built quickly. The domain may be a close misspelling of the real exchange's domain, or it may use a subdomain like "support.exchange-name-security.com" that looks plausible at a glance. Some scammers pay for search ads to put these pages at the top of results. The page may be up for only a few days before it is reported and taken down, which is why domain age is a useful check.

What Happens on the Call

When you call the number, you reach a person who identifies themselves as a support agent. They will ask for the usual details: your email address, your account name, the nature of the problem. Then they will move to the "fix."

The fix almost always involves remote access software. The most common tools are AnyDesk, TeamViewer, and sometimes the built-in remote assistance features in Windows or macOS. The agent will give you a URL to download the software, or they will walk you through starting a remote session. They will tell you this is necessary so they can "see" the problem and resolve it directly.

At that point, you are no longer dealing with a phishing site. You are dealing with a person who has live control of your computer. From here, the scam can take several forms:

• They open your browser, navigate to the real exchange site, and ask you to log in. Once you do, they can read your password and any two-factor authentication codes displayed on the screen. In some cases, they will pause the session and ask you to enter the code yourself, so they do not have to ask for it directly.
• They open your email client and search for password reset links, recovery phrases, or any messages from the exchange.
• They install a keylogger or a clipboard hijacker while you watch. The remote session is a distraction; the malware is the real payload.
• They ask you to open your wallet app or browser extension and "confirm" a transaction. The transaction is not what they described. It is a transfer to their address, often for the full balance.

The call can last anywhere from twenty minutes to over an hour. The agent will sound calm and professional. They may express sympathy for your situation. They may rush you when you hesitate. The goal is to keep you engaged long enough to complete the theft.

Why the phone call works

The phone call bypasses many of the checks that protect people online. A URL can be inspected. A wallet address can be verified. But a human voice carries authority, and the social pressure of a live conversation makes it harder to pause and think.

The scammers also exploit urgency. They will tell you your account is at risk, that a transaction is pending, or that your funds will be lost if you do not act immediately. This is a fabrication. Legitimate support teams do not ask you to install remote access software to resolve a routine issue, and they do not create time pressure.

How to check before you call

If you are on a page with a support number, do not call it until you have verified the page. The checks are the same as for any crypto site:

1. Look at the domain name closely. Compare it character by character with the official domain of the exchange. Look for swapped letters, extra characters, or unfamiliar top-level domains.
2. Check the domain age. A legitimate exchange has been registered for years. A phishing support page is often days or weeks old.
3. Go to the exchange's official website by typing the address directly into your browser, not by clicking a search result. Find the official support page from there. The phone number on the official page will differ from the one on the fake page.
4. Search for the phone number itself. Scam numbers are often reported in forums and on scam-tracking sites.

What to Do If You Already Called and Shared a Screen

If you have already given remote access to someone, act immediately:

1. Disconnect the remote session. If you can, end the connection from your side before the person on the other end can react.
2. Uninstall the remote access software. Do not just close the window. Remove the application.
3. Change your passwords from a different, trusted device. Do this before you use the compromised computer for anything else.
4. Move your crypto assets to a fresh wallet if you believe the scammers saw your recovery phrase or your transaction history. If they only saw a password, changing it may be enough, but if you typed your recovery phrase anywhere on that machine, treat the wallet as compromised.
5. Run a malware scan. Remote access scams often leave behind additional software designed to survive the session.

The limits of this page

There is no single registry of fake support numbers, and the numbers change constantly. The pattern, however, is consistent. If a "support agent" asks you to install remote access software, that is the scam. No legitimate crypto support team will ever ask you to do that. End the call.

Back to phishing