Xcelcor Guardian

A scammer had remote access to my parent's computer: what to do now

A full checklist: cut the connection, call the bank, freeze credit, clean the PC, report it, spot the 'refund' call, and talk with your parent without blame.

By the Xcelcor Guardian team · Updated

If a stranger had remote access to your parent's computer, work through this list in order. The first hour is about stopping the damage. The next days are about locking accounts and cleaning the PC. The week after is about reporting, watching for the follow-up scam, and making a repeat harder. Save this page; you'll come back to it.

Checklist at a glance

  • Right now: Hang up. Disconnect the PC from the internet.
  • First hour: Call the bank and card companies. Change the email password from another device.
  • Days 1 to 3: Freeze credit, place a fraud alert, secure accounts, clean or reset the PC.
  • Within a week: Report to the FTC and FBI, review statements, watch for a "refund" call.
  • After: Agree on a family rule and lock down remote tools.

Right now

  • End the call. If the caller is still on the line, hang up. Don't say goodbye or explain.
  • Cut the internet. Turn off Wi-Fi or unplug the cable. If that's hard to talk someone through, hold the power button until the PC turns off.
  • Don't let them back in. If they call back, hang up again. Don't open links or install anything they send.

In the first hour

Call the money first. Use the number on the back of the card or on a statement, from a phone the scammer didn't touch. Ask for the fraud department and say a scammer had remote access while your parent may have been logged in. AARP advises that the bank and the credit card company should be the first two calls, and that a bank can change the account number if scammers got in (AARP).

How money left matters:

  • Card: ask about a chargeback.
  • Gift card: call the company that issued it and say it was used to pay a scammer.
  • Wire, Western Union or MoneyGram: call right away and ask for a reversal.
  • Payment app: contact the app company, and the linked bank or card first.

The FTC lists these steps and says the sooner you act, the better (FTC, Phone Scams).

Change the main email password from your own phone or computer, not the affected PC. Email is how most other passwords get reset.

Days 1 to 3

Freeze your parent's credit. A credit freeze stops anyone opening new credit in their name. It's free to place and lift, doesn't affect the credit score, and you contact each bureau: Equifax, Experian and TransUnion (FTC).

Place a fraud alert too. It's free, lasts a year, and you only contact one bureau, which must tell the other two (FTC).

If a Social Security number or ID was shared, go to IdentityTheft.gov for a free recovery plan (FTC).

Secure accounts, from a clean device, in this order:

  1. Email (turn on two-step sign-in).
  2. Banking and cards.
  3. Shopping accounts with saved cards (Amazon and similar).
  4. Any account that shared a password with the ones above.
  5. Passwords saved in the browser: assume they were seen, and change each one.

Clean up or reset the PC. Keep it offline until then.

  • Back up photos and documents to a USB drive first.
  • Remove anything installed that day: Settings, then Apps, then Installed apps. Look for AnyDesk, TeamViewer, ScreenConnect, UltraViewer or anything unfamiliar. ScreenConnect doesn't always show in the list, so also check Task Manager (Ctrl + Shift + Esc).
  • Run a full scan with Windows Security. The FBI suggests up-to-date security software and possibly professional help (FBI).
  • If you can't be sure it's clean, reset Windows (Settings, then System, then Recovery, then Reset this PC) or ask a local repair shop.

Within a week

Report it.

  • FTC: ReportFraud.ftc.gov
  • FBI Internet Crime Complaint Center: ic3.gov
  • Local police, if money was lost (some banks ask for a report number).

Write down what you can first: the phone number that called, the name of the remote tool, any "case number", dates and amounts.

Review statements for the next few weeks, and pull free credit reports at AnnualCreditReport.com (FTC).

Watch for the recovery scam. The same group, or another, often calls back as a "refund department", lawyer or government agent who can get the money back for a fee. The FTC warns that if someone offers to help you recover money you already lost, you're probably dealing with a fake refund scam (FTC, Phone Scams). Real agencies don't charge to recover money.

How to talk with your parent

  • Lead with relief, not blame. "I'm glad you told me" keeps them telling you next time.
  • Name the trick. These callers are trained to create panic and urgency. The FBI's IC3 2025 report counts 47,794 tech-support scam complaints and about $44,000 in reported losses per complaint (IC3 2025 report). It happens to careful people.
  • Give them a job. Let them make the bank call with you on speaker, or keep the notes. It helps them feel in control again.
  • Agree on one rule. "If anyone asks to get on the computer, I hang up and call you." Write your number by the PC.
  • Get support if needed. AARP's free Fraud Watch Network Helpline, 877-908-3360, offers guidance to victims and families (AARP Helpline).

Make a repeat harder

One more layer

Xcelcor Guardian is a Windows 11 app that holds new connections from Quick Assist, AnyDesk, TeamViewer, ScreenConnect and other common remote access tools until you approve them by email or on xcelcor.com. You choose Allow once, which covers only that live session, or Always allow for a caller ID you trust, such as your own helper, which applies across your account until you remove it. Your parent only gets a Refuse button. It doesn't cover Microsoft Teams or Zoom screen control or Windows Remote Assistance (msra.exe). It lowers the risk; it can't prevent all scams. Start free for 14 days on one PC, no card needed.

Last updated

All guides in the Scam Library