Remote access emergency
Is someone on your computer right now?
If a stranger is controlling your PC — or a caller is telling you to let them in — do these three things first. It takes about a minute, and it ends the session.
-
Disconnect from the internet
This ends a remote session immediately. Press Windows + A and turn on Airplane mode, switch off Wi-Fi, or unplug the network cable. If none of that works, switch off your Wi-Fi router.
-
Hang up the phone
Don’t read out any codes, IDs or passwords, and don’t stay on the line “to finish the repair”. A real company won’t mind you calling back.
-
Don’t open your bank on that PC
Leave it disconnected until you have checked it. Anything you type on it now could be seen.
Then, from a different phone or computer:
-
Call your bank
Use the number on the back of your card — never one the caller gave you. Ask them to watch for transfers and new payees.
-
Change your email password
Email first, because it resets everything else. Then banking. Turn on two-step sign-in wherever it’s offered.
Last reviewed September 2026
How to tell if someone is controlling your computer
- The mouse moves on its own
The pointer moves, clicks or types when you aren’t touching anything.
- A remote-support window is open
AnyDesk, TeamViewer, ScreenConnect or Quick Assist on screen, in the taskbar, or by the clock.
- The screen goes black
A blank or “please wait” screen while the caller says they’re fixing something — it hides what they are doing.
- The caller can see your screen
They describe what’s in front of you, or tell you exactly where to click.
Not a reliable sign on its own: a slow computer, or a pop-up claiming you’re infected. That pop-up is usually how these scams start, not proof that someone got in.
Check your PC for remote-access software
Keep it disconnected while you do this. It takes about two minutes.
Look by the clock
Click the small ^ arrow at the bottom-right of the taskbar. A remote-support icon there means the tool is running.
Check your installed apps
Open Start → Settings → Apps → Installed apps (on Windows 10, Apps & features). Look for anything installed recently that you didn’t choose.
Check what’s running
Press Ctrl + Shift + Esc to open Task Manager and look for the same names.
Names to look for
- AnyDesk
- TeamViewer
- ScreenConnect
- UltraViewer
- RustDesk
- LogMeIn
- Supremo
- Zoho Assist
Quick Assist is built into Windows, so finding it isn’t a sign by itself — but it can be used the same way. If you find a tool you didn’t install for someone you trust, uninstall it before you reconnect, then run a full scan in Windows Security → Virus & threat protection.
What to do after a remote access scam
- Remove what they installed before reconnecting. If you’re unsure what’s safe, ask a technician you already know.
- Report it at ReportFraud.ftc.gov and to the FBI at ic3.gov.
- Paid with gift cards? Contact the company that issued them now — sometimes the money can still be frozen.
- Shared personal details? Visit IdentityTheft.gov and consider freezing your credit.
- Ignore “recovery” callers. Anyone offering to get your money back for a fee is running a second scam.
Next time, nothing connects without approval.
However convincing the caller is.
Xcelcor Guardian blocks every new remote connection to your PC until someone you trust approves it — so a stranger can’t talk their way back in.
Common questions
How do I stop someone from remotely accessing my computer right now?
Disconnect it from the internet. Press the Windows key and A, then turn on Airplane mode, switch off Wi-Fi, or unplug the network cable. A remote session cannot continue without a connection. Then hang up the phone and do not read out any codes.
How can I tell if someone is controlling my computer?
The mouse moves or types on its own, a remote-support window or icon such as AnyDesk, TeamViewer, ScreenConnect or Quick Assist is open, the screen goes black while the caller says they are working, or the caller can describe what is on your screen. A slow computer on its own is not a sign.
Can a scammer get back into my computer after I disconnect?
Yes, if the remote-access tool is still installed and set up to let them in without a code. Remove any remote-support software you did not choose before you reconnect, and never read out access codes to a caller.
Is AnyDesk or TeamViewer a virus?
No. They are legitimate remote-support tools, which is why antivirus usually stays quiet. The danger is the stranger using them. Uninstall them if you did not install them yourself for someone you trust.
Will Microsoft or my bank call me to fix my computer?
No. Microsoft does not make unsolicited calls to fix computers, and banks do not ask to connect to your PC. Hang up, and call the number on the back of your card or on the company's official website.
I already gave them access or paid them. What do I do now?
From a different phone or computer, call your bank or card company using the number on your card, change your email password, and report it at ReportFraud.ftc.gov and ic3.gov. If you paid with gift cards, contact the company that issued them straight away.