Remote access scams: how they work
Why the dangerous part is often a legitimate remote-support tool.
A remote access scam is any scam where someone talks you into letting them control your computer. They don’t break in. You let them in, because by the time they ask, they’ve given you a good reason to.
That’s what makes these scams different from a virus. The program they use is usually real software that IT departments rely on every day, so your antivirus has no reason to object. The problem is the person holding the mouse.
How it usually goes
The stories change from call to call. The order of events hardly ever does.
- Something gets your attention: a phone call, a text, an email about a payment you didn’t make, or a pop-up with a phone number on it.
- There’s a problem. Your computer is infected, your bank account is being used by criminals, you’ve been charged $399 for a subscription, or you’re owed a refund.
- They offer to help, but they need to see your screen. They walk you through installing AnyDesk, TeamViewer, Quick Assist or something similar, and ask you to read out a code.
- They connect. Now they can see and do everything you can.
- They go after the money. You’re asked to log in to your bank “to check”, to buy gift cards, or to move savings somewhere “safe”. Often you make the payment yourself while they watch, which makes it much harder to get back.
Step four is the one that matters. Without the connection, the rest of the script falls apart.
The stories they use
The virus warning
A browser page fills the screen, often with a loud alarm, saying your computer is infected and giving a number for “Microsoft Support”. It’s just a web page. Our guide to fake Microsoft support scams explains how to close it.
The refund
An email says your antivirus or computer support plan has renewed for a few hundred dollars. You call to cancel. They offer a refund, connect to your PC to “process” it, then show you that they accidentally refunded far too much. Could you send back the difference? The extra money was moved from your own savings into your checking account, or the number on the page was simply edited. What you send them is real.
The bank or the police
Someone from your bank’s “fraud team” says your account has been compromised. They need remote access to secure it, and you need to move your money while they do. A real fraud department will never ask you to move your money to protect it.
The help you went looking for
You search for a company’s support number and call the first one you see. Some of those results are paid ads placed by scammers. The person who answers is happy to help, as long as they can connect to your PC first.
Why antivirus doesn’t stop it
AnyDesk and TeamViewer aren’t malware. Millions of people use them for good reasons, and antivirus can’t tell a helpful nephew from a stranger in a call center. Blocking the tools outright would break genuine support. So they install cleanly, and the connection goes through, because you agreed to it.
Some scammers do install real malware once they’re in, or a second remote tool that stays behind after the call. That’s why it’s worth checking the computer afterwards, even if the session seemed short.
Who gets targeted
Older people are targeted most and tend to lose the most, partly because they’re more likely to answer an unknown number and more likely to have savings. But the refund and bank stories catch people of every age, and so do fake support numbers in search results.
How to protect yourself
- Never let anyone connect to your computer because they contacted you. Only allow it when you started the conversation, with a person or company you already know.
- Get support numbers from the company’s own website or your paperwork, not from a search ad, a pop-up or an email.
- If a caller says they’re your bank, hang up and call the number on your card. A real bank won’t mind.
- Uninstall remote-support tools you don’t use.
- Put an approval step between the request and the connection, somewhere the caller can’t reach.
Where Guardian fits
That last point is what Xcelcor Guardian does. When anything asks to connect to the PC, Guardian holds the connection and asks the account holder to approve it, by email or on our website. That can be you, or someone you trust, like a son or daughter. The PC itself only has a Refuse button, so however persuasive a caller is, there’s nothing on that screen for them to talk you into pressing. Support you trust can be allowed once, or every time.
If you think it has already happened, start with what to do after a remote access scam.
Last updated