Broadband Router Upgrade Scam
Fraudsters pose as broadband providers offering a free or heavily subsidised router upgrade, then use the visit or call to install malware, steal credentials, or charge hidden fees.
Last reviewed: 1 June 2026
What this scam is
Broadband router upgrade scams involve callers or door-to-door visitors who claim to represent the customer's internet service provider and offer a free or discounted new router. The interaction is used either to install remote-access software on connected devices, to steal broadband account credentials, or to charge undisclosed fees through a contract signed under misrepresentation.
Broadband providers do periodically contact customers about equipment upgrades, which gives the scam a plausible backdrop. The fraudster exploits brand familiarity and the genuine expectation that providers will upgrade equipment over time.
The scam causes harm in multiple ways. In the malware variant, a technician visits and connects a fraudulent device or installs software that gives attackers access to the home network. In the credential-theft variant, a caller guides the customer through 'configuration steps' that involve entering their account login credentials on a fake portal. In the fee variant, a 'free upgrade' turns out to carry installation charges or a new contract commitment that was not disclosed clearly.
Home broadband is now critical infrastructure for most households — it supports working from home, banking, children's education, and communication. An attacker who gains access to a home router or network can monitor traffic, intercept credentials, and compromise every device connected to it.
How it works
In the call variant, the fraudster contacts the customer by phone, claims to be from the broadband provider's technical or upgrades team, and explains that a new, faster router is available. They ask the customer to follow a sequence of steps on their computer to 'prepare' for the upgrade — steps that include downloading remote-access software or visiting a fake configuration page where login credentials are entered.
In the doorstep variant, someone arrives claiming to be a field engineer from the provider, carrying an official-looking box and tools. They explain they are in the area performing upgrades. They connect a device to the customer's router, which may install monitoring software, or they ask to 'test' the broadband speed on the customer's computer and use the opportunity to install software.
Some variants focus on extracting a payment for the 'upgrade kit' or a first month's fee for a 'new enhanced contract'. These payments are made by card or bank transfer and are not refunded. The customer later discovers no upgrade was performed and no new contract exists with the real provider.
Why this scam works
Router upgrades are a normal and expected part of broadband service — providers do send new equipment. The offer of improved speed or newer technology is genuinely attractive. Because the offer is framed as a benefit (a free upgrade) rather than a request (pay for something), the natural caution that accompanies a financial request is reduced.
For the doorstep variant, the physical presence of someone in a uniform or with official-looking equipment creates credibility that a phone call alone could not. Most people have no way to independently verify whether a field engineer visit was genuinely scheduled.
Common red flags
- Unsolicited call offering a free router or connection upgrade
- Request to download software as part of the upgrade process
- Request to enter broadband account credentials on a website during the call
- Door-to-door visit not confirmed when you call the provider's official number
- Request for payment for an upgrade that was described as free
- Caller becomes impatient when you suggest verifying independently
- Door visitor unable to show verifiable identity credentials
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Hi, this is [provider] — we're upgrading routers in your area this week. I can get you set up with the new [model] today. Can I take a few minutes of your time?
[Provider] upgrade available: your current router is no longer supported. Click [fake link] to arrange your free replacement.
Your broadband speed can be improved immediately. Our engineer is in your area today. Please call [phone number] to schedule the free upgrade.
We've noticed slower-than-expected speeds on your line. Download our diagnostic tool at [fake link] to prepare for the upgrade.
Common variations
- Remote-access installation variant — caller guides customer to install monitoring software
- Credential harvest variant — fake configuration portal captures broadband login
- Hidden contract fee variant — 'free' upgrade includes undisclosed charges
- In-person device planting — doorstep visitor connects a rogue device
How to verify before you act
If you receive a call about a router upgrade, hang up and call your broadband provider directly using the number on your bill or their official website. Ask them to confirm whether an upgrade is genuinely scheduled for your account.
If someone arrives at your door claiming to be from your provider, ask to see their identity card and do not let them connect any device until you have called your provider's official number to confirm the visit was scheduled.
Never download software at the instruction of someone who called you. Legitimate broadband providers do not remotely configure your equipment by talking you through software downloads — they send equipment with instructions or use their own tools during authorised engineering visits.
Do not enter your broadband account credentials on any website you were directed to by a caller. Navigate to your provider's website by typing the address yourself.
Payment methods used
- Cryptocurrency
- Bank/wire transfer
- Gift cards
- Money transfer services
- Payment apps to 'friends & family'
Who is usually targeted
- Residential broadband customers
- Older adults less familiar with their provider's normal contact patterns
- Customers who have recently queried connection speed or service issues
- Households with multiple connected devices
What to do immediately
- Do not download any software or follow configuration instructions from an unsolicited caller
- If you let a visitor connect a device, disconnect it and contact your provider immediately
- If you entered credentials on a third-party site, change your broadband account password immediately
- Call your provider using the official number to check whether any upgrade or visit was genuine
- If you paid a fee, contact your bank to attempt recovery
- Report the contact to your national fraud authority
How to prevent it
- Verify any router upgrade contact by calling your provider using the number on your bill
- Never download software from an unsolicited caller
- Do not allow a doorstep visitor to connect devices until you have verified the visit with your provider
- Keep your router's admin password changed from the default and not shared with third parties
Evidence to preserve
- Caller ID or description of the caller
- Any links or software download instructions provided
- Description of any device left connected to your router
- Payment records if a fee was charged
- Email or text content from the contact
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
How do real broadband providers offer upgrades?
Real providers typically communicate upgrades by letter, email, or notification in your online account. Genuine field visits are scheduled in advance and confirmed. If a visit is unexpected, call your provider's official number before allowing any access.
A technician connected something to my router — what should I do?
Disconnect the device immediately. Power cycle your router. Change your broadband admin password and any credentials you may have entered. Call your provider to confirm whether the visit was genuine. If not, report to your national fraud authority.