Fake Microsoft / Apple / McAfee tech support scam — fraudulent email impersonating Microsoft, Apple, Windows Defender, McAfee, Norton, or Avast claiming a virus, malware, or security threat has been detected on the recipient's computer, or that a security license has expired — directing them to call a toll-free support number, contact a technician, or not shut down the device, a high-volume phone-based fraud that leads to remote access scams and fake repair charges

Fraudulent emails impersonating Microsoft, Apple, Windows Defender, McAfee, Norton, or Avast — claiming a virus, malware, or security breach has been detected on the recipient's computer, that a security license has expired, or that the device has been compromised — then directing them to call a toll-free support number, contact a technician, or avoid shutting down the device. This is the email delivery vector for the broader tech support scam ecosystem, which typically escalates to a phone call where scammers request remote access and charge for fake repairs. Key facts: (1) Tech support scams cost Americans $924M in 2023 (FTC Consumer Sentinel 2024); the median individual loss was $500, with older adults disproportionately targeted; (2) Microsoft is the most impersonated tech brand in support scams by volume — the company receives hundreds of thousands of annual reports; the "Microsoft Security Alert" and "Windows Defender" variants are the highest-volume email lures; (3) The scam's three-stage structure: (a) email/popup lure creates urgency (virus detected, license expired); (b) call to fake support line — scammer spends 20–60 min establishing trust; (c) request for remote access (TeamViewer, AnyDesk) to "fix" the fake problem while actually stealing data or installing malware; (4) Legitimate Microsoft, Apple, and security software companies never proactively email users with virus alerts, demand phone calls, or instruct users not to shut down their devices. Warning signs: impersonated tech brand + virus/malware alert, call toll-free number CTA, do-not-shut-down instruction, files-at-risk threat.