Someone remotely accessed my computer. What now?
What to do in the first few minutes if a stranger had control of your Windows PC.
If a stranger is on your computer right now, stop reading and cut its internet connection. Turn on airplane mode, switch off Wi-Fi, or pull out the network cable. If you can’t find any of those, switch off your router. The remote session ends the moment the connection does. If someone is still on the phone, hang up. You can finish reading this on your phone.
Done that? Good. Everything else can happen at a normal pace, in this order.
The first ten minutes
Most people want to fix the computer first. Leave it. The computer can wait an hour. Your bank account and your email can’t.
- Keep the PC offline. Don’t reconnect it to check something quickly. If they left a program behind, it may connect again on its own as soon as the internet is back.
- Call your bank from a different phone, using the number on the back of your card. Tell them someone had remote access to your computer, and ask them to look for transfers, new payees and changes to your contact details. If you signed in to online banking while the caller was connected, say so.
- Change your email password, from your phone or another computer. Email comes first because every “forgot password” link goes there. Then banking, then anything else you used on that PC recently.
What they could have seen
While someone is connected, they see everything you see. If you opened your bank while they were on, assume they saw your balance and anything you typed. If they asked you to log in “so they can check for hackers”, that was the point of the whole call.
They can also copy files, install programs and change settings. Most aren’t interested in your photos. They want money, usually by getting you to move it yourself while they watch, or by sending you out to buy gift cards and read them the numbers.
While you still remember, write down when the call started, the number that called you (or the one you rang), the name of the program they had you install, any website they sent you to, and anything they asked you to type. Your bank will ask for these, and so will the police.
Check what they left behind
Most of these scams use a genuine remote-support program such as AnyDesk, TeamViewer or ScreenConnect. Antivirus often leaves it alone, because it isn’t a virus. So you have to look for it yourself. Keep the PC offline while you do.
- Open Settings, then Apps, then Installed apps (on Windows 10 it’s Apps & features). Sort the list by install date and look at anything from the day of the call.
- Click the small ^ arrow next to the clock and look for icons you don’t recognize.
- Press Ctrl + Shift + Esc to open Task Manager and look at the Startup apps tab. Anything new there starts every time Windows does.
Uninstall any remote-support program you didn’t install for someone you trust. If something won’t uninstall, or you’re not sure what you’re looking at, leave the PC offline and ask a technician you already know. Our step-by-step check lists the names to look for.
Do I need to wipe the computer?
Not always. If they were only connected for a few minutes and you’ve removed the program they used, a full scan is usually enough. In Windows Security, go to Virus & threat protection, then Scan options, and run a full scan followed by the offline scan. The offline scan restarts the PC and checks it before Windows loads.
A full reset is worth the trouble if they were connected for a long time, typed commands into a black window, asked for your Windows password, or if you keep finding programs you didn’t install. Copy your documents and photos somewhere safe first, then use Reset this PC and choose to remove everything.
Over the next few days
- Check your bank and card statements again. Small test payments often come before big ones.
- Look in your email’s sent folder, and in its settings for forwarding rules you didn’t create. A rule that quietly copies your mail somewhere else is a common leftover.
- Turn on two-step sign-in for your email and your bank.
- Report it. In the US that’s ReportFraud.ftc.gov and the FBI at ic3.gov. A report rarely brings money back by itself, but it helps when your bank looks into what happened.
- Expect a second call. People who’ve been scammed often hear from someone offering to recover the money for a fee. That’s the same scam again.
This happens to careful people
The people running these calls do it all day. They know which words make someone panic and which make them trust. Plenty of sensible, clever people have been caught by a good one, usually on a bad day or in a hurry. If it happened to a parent, try not to make them feel foolish. People who feel embarrassed stop mentioning the next call.
Stopping the next one
These scams only work because the person on the phone can talk you into letting them connect. Xcelcor Guardian takes that decision out of the moment. Every new remote connection to the PC waits for approval from the account holder, which can be you or someone you trust, by email or on our website. There’s no approve button on the PC itself, so there’s nothing for a caller to talk you into clicking. If nobody approves within ten minutes, the connection is dropped.
You can try it free on one PC for 14 days, without a card.
Last updated