Tech-Support Scams Hit Workplaces Too: 68 IPA Cases, One Stopped by Powering Off

Hello. This is Shemihaza, your sentinel.
Today is about scams that get into a workplace PC through a phone call.
The source is the latest quarterly report (April to June) from the corporate consultation desk of IPA, Japan's Information-technology Promotion Agency, published on 22 July 2026. The phone numbers and agencies in this article are Japanese; readers elsewhere can use the same steps with their own local services.

Tech-support scam consultations numbered 68 in that quarter. The previous quarter had 41, an increase of about 66% (this site's calculation).
That 68 is higher than both "incident response" (65) and "routine measures" (21) at the same desk.
IPA says combinations of a phone call and remote-control software are rising, not just fake warning screens on a PC.

This article walks through one case IPA published, step by step.
★In that case someone stopped it before it spread. The thing that stopped it was not technology: a colleague noticed something was wrong, put the call on hold and powered the PC off.
The August article covers how to close a fake warning screen at home. Today is the workplace phone version.

Tech-support scams are rising for organisations too

• ▸April to June 2025: 52 cases
• ▸July to September 2025: 20 cases
• ▸October to December 2025: 33 cases
• ▸January to March 2026: 41 cases
• ▸★April to June 2026: 68 cases (302 consultations in total that quarter, so about 22.5% by this site's calculation)

At IPA's consumer desk, "fake virus-detection warnings" came to 1,428 cases, 37.3% of all consultations.
Both figures come from IPA's reports. The same technique is rising at home and at work at the same time.

The case IPA published: from one call to remote control

This is the automated call posing as the National Tax Agency that IPA's corporate report lists as a consultation case. In order:

• ▸1. An automated call: an employee answers; the voice poses as the tax agency and says the e-Tax software needs updating. To hear the explanation they are told to press "1", and they did
• ▸2. A man takes over: the recording is replaced by a man posing as the e-Tax help desk. He says he will email the data and guide them by phone, and asks for an email address, which they gave
• ▸3. An email arrives at once: the sender poses as e-Tax with a .jp email address. The subject and body match the phone call, in natural Japanese, and the signature also claims to be the tax agency
• ▸4. Automatic download and install: following the phone instructions, they open the URL and an e-Tax look-alike page appears and a download starts automatically. As told, they installed the file
• ▸5. A "preparing" screen: the PC shows "preparing the e-Tax update" and the caller explains that installation takes about 10 minutes
• ▸★6. It stopped: another employee became suspicious, put the call on hold, powered the PC off, and hung up the held call

★Even with natural-looking email, the clues are on the phone side

IPA's notes on this case show it cannot be spotted by appearance alone.
- The sender is shown as e-Tax, with a .jp address
- Subject and body match the call, in natural Japanese
- The URL leads to a .jp e-Tax look-alike site
So "does the email look wrong?" is a weak test against this technique.

That is why the clue is in the flow.
Being told to press 1, being kept on the phone while an email is sent, being told by phone to install a file: in all three, the caller is holding the controls.
This is this site's own breakdown, but cutting the flow anywhere along the way stops the damage. The lower half of the figure shows where.

Why workplaces are harder to stop (IPA's summary)

IPA summarises the traits of scams aimed at organisations like this.

• ▸Entry is by phone, email, web or chat, and they press urgency and anxiety to get employees to act quickly
• ▸They pose as real companies, organisations, executives, business partners or public bodies, and are hard to tell from genuine contact
• ▸★They steer victims into "closed" channels such as phone, chat or LINE, so that nobody else is consulted or checks
• ▸Combining remote-control software with a phone call to make victims carry out authentication steps themselves, including two-factor authentication, is increasing. IPA also names victims being unable to judge the risk of remote-control software as a cause

★IPA adds that organisations with solid checking systems, or where several people handle things, appear to find it harder for the scam to go further.
This case stopped because colleagues around the person on the call noticed.

If you may already have installed it (IPA's answer)

This is IPA's answer to the case. You can also read it as an order of actions if the same thing happens on your own PC.

• ▸It cannot be determined what software was installed or what ran, so IPA recommends re-initialising the PC for safety
• ▸Minimum step 1: change the passwords used on that PC, including passwords for internet services that the browser fills in automatically
• ▸Minimum step 2: check the services used on that PC for unauthorised use. If there are credit cards or online banking, consult the card issuer or bank at once
• ▸Minimum step 3: if personal information was stored on it, a duty to report to the Personal Information Protection Commission may arise, so consult the Commission
• ▸To find out what was done, a digital forensics investigation can sometimes tell, so consider asking a security vendor. In that case do not re-initialise immediately; keep the PC powered off, preserve it, and follow the vendor's instructions
• ▸Delete the email that was sent

Note: "re-initialise" and "keep it for investigation" cannot both be done.
IPA recommends re-initialising first, but if you want an investigation, preserve the PC powered off before re-initialising. When unsure, do not decide alone; ask your IT contact or the vendor.

What you can do today

• ✓If an unknown automated call says "press 1", do not press it; hang up. The way into this case was that "1"
• ✓Do not give the caller your email address. In the case, the email arrived right after the address was given
• ✓Do not open email links or install files while being instructed by phone. Cut the flow where the caller holds the controls
• ✓★If you get suspicious midway, put the call on hold and call out to the people around you. What stopped this case was a colleague's "hold" and "power off"
• ✓If anyone asks you to install remote-control software, suspect a scam on the spot. IPA says combining remote control with phone calls is increasing
• ✓Do not proceed on one person's judgement. As a countermeasure IPA lists building internal rules and workflows so that one employee's decision cannot cause damage
• ✓The same applies at home. How to close a warning screen on a home PC is in the August article

Three lines to send to family

• ▸If a call says "press 1", do not press it; hang up. Do not give the caller your email address
• ▸Do not open links or install software while being told to by phone. If you already did, put the call on hold and power the PC off
• ▸★When in doubt, call the police advice line #9110 (Japan); if you have paid money, the Consumer Hotline 188 (Japan). For a work PC, tell your IT contact instead of deciding alone

Where to get help

Police advice line #9110 (Japan; consult the police)
Consumer Hotline 188 (Japan; if you paid money or were pressed into a contract)
IPA also runs a consumer-facing "Information Security Consultation Desk" and a corporate "Cybersecurity Consultation Desk". For a work PC, reporting to your company's IT contact comes first.

Pages this article is based on