What to do after a remote access scam
After the call ends: your money, your accounts, the computer, and reporting it.
The call is over, or you’ve just realized what it really was. This checklist is in order of what’s most urgent. Do the first part today, even if you’re tired and upset. The rest can wait until tomorrow.
Right now
- Take the computer offline: airplane mode, Wi-Fi off, or unplug the cable. Leave it that way until you’ve checked it.
- Don’t pick up if they call back. They often do, sometimes pretending to be someone new.
- Call your bank on the number on your card, from a different phone. Tell them what happened, including whether you signed in to online banking while they were connected and whether you read out any codes sent to your phone. Ask them to stop transfers and check for new payees.
- If you paid with gift cards, call the company that issued them straight away, and keep the cards and receipts. If you used a wire service, a Bitcoin ATM or a payment app, contact that company too.
Today
Do these from a phone or a different computer, not the one they were on:
- Change your email password first. Whoever controls your email can reset almost everything else.
- Then change the passwords for your bank, shopping sites with saved cards, and anything you signed in to on that PC recently.
- Turn on two-step sign-in for email and banking.
- In your email settings, look for forwarding rules or filters you didn’t create, and delete them.
- Write down what you remember: times, phone numbers, the names they used, websites, the program they installed and how you paid. It’s much easier now than in a week.
Clean up the computer
Most scammers use a genuine remote-support program, which antivirus won’t necessarily remove. You have to find it yourself.
- Open Settings, then Apps, then Installed apps (Apps & features on Windows 10), and sort by install date. Uninstall any remote tool you didn’t install for someone you trust: AnyDesk, TeamViewer, ScreenConnect, UltraViewer, RustDesk, LogMeIn, Supremo and the like.
- Check the Startup apps tab in Task Manager (Ctrl + Shift + Esc) for anything new.
- Run a full scan, then the offline scan, in Windows Security.
If they were connected for a long time, asked for your Windows password, or you keep finding things you didn’t install, it’s safer to back up your files and reset Windows completely. A local technician you already know can do this for you.
Our step-by-step check walks through where to look.
This week
- Report it. In the US, use ReportFraud.ftc.gov and the FBI’s ic3.gov. If you lost money, a police report can help with your bank’s claim.
- If you shared your Social Security number, ID documents or bank details, go to IdentityTheft.gov for a recovery plan, and consider freezing your credit with Equifax, Experian and TransUnion. It’s free.
- Keep an eye on your bank and card statements for a few weeks. Small charges sometimes come before big ones.
- Tell people. If a parent was caught, let the rest of the family know what kind of calls to expect. If it was you, telling a friend makes the next one easier to spot.
Can I get my money back?
Sometimes. Card payments can often be disputed. Bank transfers are harder, but always worth asking about, especially if you call quickly. Gift cards can sometimes be frozen if they haven’t been spent yet. Crypto is very hard to recover.
Your bank is more likely to help if you report it quickly and can show what happened, which is why those notes matter.
Watch out for the recovery scam
After a scam, many people get a call, email or message from someone offering to get their money back. They might say they’re a lawyer, a government agency, or a company that traces stolen funds. They want a fee first.
This is almost always a second scam, sometimes run by the same people who took the money in the first place. Real agencies don’t charge to investigate, and nobody can promise to get your money back.
Making sure it doesn’t happen again
A clean computer and new passwords fix today. They don’t stop the next call, and people who’ve been scammed once are often targeted again. Xcelcor Guardian holds every new remote connection until the account holder approves it, by email or on our website, so the next caller can’t simply talk their way onto the PC. You can try it free on one PC for 14 days, without a card.
Last updated