Fake bank "support chat" downloads AnyDesk so scammers can get into your computer

A warning about your bank account sends you to a fake bank site whose "live chat" downloads AnyDesk and asks for your code.

By the Xcelcor Guardian team · Reported October 12, 2026

Is it a scam?

Yes, it's a scam. Your bank's real website won't download AnyDesk or any other remote access program when you open a chat.

Type

Fake website

First reported

October 8, 2026

Status

Still active

Who it targets

Bank customers in the US and Canada, including business banking customers

Tools it uses

AnyDesk

If a call, email or text about a problem with your bank sent you to a page with a "live chat", and a file started downloading when you opened the chat, it's a scam. The file is AnyDesk, a real remote access program, and the person in the chat wants your code so they can get into your computer. Don't open the file and don't give them any code.

Researchers at the security company Fortra described these attacks in a report on October 8, 2026. They say the campaigns mostly go after customers of banks in North America, including business banking customers. Fortra says it first saw them aimed at US banks in the second half of 2025 and that they grew sharply in early 2026.

What does the fake bank chat look like?

It usually starts with a phone call, an email or a text saying there's a serious problem with your bank account. You're sent to a website made to look like your bank, with what seems to be a live customer support chat.

According to Fortra, the page checks what kind of computer you're using. As soon as you open the chat, the right version of AnyDesk starts downloading by itself. The "agent" then talks you through installing it and asks for the connection code AnyDesk shows on screen. With that code, they can see and control your computer.

Why doesn't my antivirus stop it?

AnyDesk is a genuine program that IT staff use every day. Antivirus software often won't flag it, because there's nothing wrong with the program itself. The danger is the person on the other end.

I got the message but didn't do anything

You're fine. Delete the email or text. If a file downloaded, delete it from your Downloads folder without opening it. If you're worried about your account, call your bank using the number on the back of your card or on a statement, not a number or link from the message.

I installed it or gave them the code. What now?

Act now, even if nothing seems wrong yet. Fortra warns the attackers may steal logins and personal details, or install other harmful software.

1. Disconnect the PC from the internet (unplug the cable or turn off Wi-Fi).
2. Call your bank from another phone, using the number on the back of your card. Tell them someone may have had access to your computer.
3. Change your email password from a different device, then your bank password.
4. Uninstall AnyDesk (Settings, then Apps, then Installed apps on Windows 11, or "Apps & features" on Windows 10).
5. Report it at ReportFraud.ftc.gov and ic3.gov.

Our two-minute checklist goes through each step, and what to do after a remote access scam covers what to check in the days after.

How to tell it's fake next time

A bank chat should never download anything to your computer. Your bank doesn't need AnyDesk, TeamViewer or any other remote access program to help you. If a message says your account has a problem, don't follow its link. Type your bank's address yourself or call the number on your card. Our AnyDesk scams guide explains the other ways scammers ask for these codes.

If you'd like a second line of defense, Xcelcor Guardian holds every new remote connection on a Windows 11 PC, including AnyDesk, until the account holder approves it by email or on xcelcor.com. It doesn't stop the fake website, but it can stop a stranger connecting just because you read out a code.

Last updated October 12, 2026