Gave a Scammer Remote Access to Your Computer? What to Do Next

If you let an unknown “support agent” control your computer, end the session and disconnect that computer from the internet. Then use a different, trusted device to contact your bank if money or account details were exposed, secure your main email and other important accounts, and plan a careful check of the computer. You do not need to prove that malware was installed before taking these steps. Remote access is enough reason to treat what the person could see or change as exposed.¶

The order matters. Changing a password on a computer the stranger may still control could show them the new password. Wiping the computer immediately could remove details you need for a bank dispute or a report. Work through the urgent risks first, keep a short record, and get trusted help if you cannot tell what the person did.¶

If the session is still open, end the call or chat. On the affected computer, close the remote-support session if you can do so safely, then turn off its Wi-Fi or unplug its network cable. If you cannot find the control, shut down the computer. You can use another phone or computer to get help and manage accounts. Do not follow the caller's instructions to “finish the repair,” transfer money for safekeeping, or install another tool.¶

Disconnecting cuts off a live internet session. It does not remove software already installed, undo a payment, or erase information the person may have copied. Do not reconnect the affected computer to check your bank or email. Use a trusted second device for those checks. If this is a work or school computer, tell your IT or security team as soon as possible; they may need to preserve evidence and handle the device themselves.¶

Some people only saw a pop-up and never granted control. That is a different situation. A browser warning with a phone number is a common support-scam lure, but seeing it alone does not mean the computer was taken over. Close the page without calling its number, and investigate any download or permission you actually gave. This guide is for the more serious case where someone obtained remote control, watched your screen, or directed you to install support software.¶

Write down what happened while it is fresh: the approximate time, how contact began, the name of any remote tool, what windows were open, whether you typed passwords or one-time codes, what files were opened, and whether a payment was made. Save the caller's number, messages, receipts and payment references if available. Do not send screenshots containing private information to an unsolicited “recovery expert.” A phone number on the call display can be spoofed, so record it as a clue, not proof of identity.¶

You may not know everything the person saw. Remote control can let them view the screen, open files and install programs. An open bank or email session raises the priority of those accounts even if you did not type a password during the call. A closed, locked account is a different level of exposure, but the person may still have changed system settings or installed a tool. Treat the unknowns honestly instead of assuming either that every account is stolen or that nothing happened because the screen looks normal.¶

Use this triage to choose the next call:¶

These are priorities, not a prediction of loss. If several rows apply, act on the financial and primary-email risks in parallel with help from someone you trust.¶

If you paid, entered card details, showed a bank balance, logged in to banking, or were told to move funds, contact your bank or card provider immediately through its official app or a number you already trust, such as the one on your card. Explain that an unknown person controlled your computer and describe what they could see. Ask what they can do about pending transactions, account access, card replacement and a dispute. The options depend on the payment method and country; no article can guarantee a reversal.¶

Do not rely on a balance or “refund” the caller showed on the compromised computer. A scammer can manipulate what you see. Check transactions directly with the bank from the second device. If the caller claims they sent too much money and demands a return transfer, stop. Ask the bank to verify any real movement. Save transaction IDs and the time of each call so you can follow up without reconstructing the story later.¶

If you paid with a payment app, wire service, gift card or cryptocurrency, contact the service used as quickly as possible and ask about its scam process. Different methods have different recovery chances. Use contact details from your own account, card or official search, not from the suspicious message. If you shared identity documents or other sensitive personal information, ask your local consumer or identity-theft authority what protections fit your jurisdiction.¶

Start with the primary email account because it often receives password resets. On a trusted phone or computer, open the provider's official app or enter its address yourself. Change the password if it was typed, shown, reused elsewhere, or you see suspicious activity. Review recent sign-ins, signed-in devices, recovery email and phone number, forwarding rules and any unfamiliar app access where the provider offers those controls. Sign out sessions you do not recognize and enable a second sign-in factor. A password change alone may not remove an already active session or a forwarding rule.¶

Next handle banking, your password manager, cloud storage, shopping and social accounts in the order that matches what was open or used during the session. Give each account a unique password. If the same password was used in more than one place, change every affected account. Review account activity and recovery settings, not just the sign-in screen. If you cannot log in, follow the provider's own recovery path; avoid services that promise instant recovery for a fee.¶

If the scammer may have seen a one-time code, identify which account sent it. Check for a completed sign-in, new device, changed recovery setting or transaction. Do not tell the scammer a new code even if they claim it is needed to cancel the old one. If you suspect your email was separately exposed in a breach, the Allblogs data-breach guide explains that account-specific case.¶

It can feel tempting to change everything at once. Begin with accounts that can unlock other accounts or move money. Keep a private list of what you changed and what still needs review. Do not store new passwords in a note or screenshot on the computer you are investigating.¶

Once the urgent account and money steps are underway, decide how to make the affected computer trustworthy again. Do this with guidance from the device maker or a technician you already know if you are unsure. Reconnecting briefly for updates or an official security scan may be needed, but avoid using the computer for banking, email or password changes until you have assessed it.¶

On a Windows computer, look for the remote-support application the caller asked you to install and uninstall it through Windows' installed-apps controls. Update Windows and your security software, then run a full scan. Microsoft advises considering a reset after a scammer had access, particularly when suspicious behaviour persists. A scan can find known threats; a clean result does not establish what files were viewed, whether data was copied, or that every change has been reversed.¶

On a Mac, check for the application used during the session and review Screen Sharing and Remote Management in System Settings under General and Sharing. Turn off unexpected sharing. Apple notes that screen sharing can permit another computer to view and control your Mac. An unfamiliar setting or program is a reason to seek official support, especially if the caller had an administrator password. Do not copy a complicated removal command from a stranger's message.¶

Look for changes that fit the incident: a new account on the computer, unexpected login items, unfamiliar browser extensions, changed security settings, or repeated fake alerts. These are leads, not a complete forensic test. Removing one visible remote tool may not reverse another change. If you cannot account for what was installed, the caller had administrator access, security software reports a threat, or odd behaviour continues, ask a trusted professional about a reset or clean reinstall.¶

Before any reset, confirm that important files are backed up and that you can regain access to your accounts, recovery codes and encryption key if applicable. A reset may remove apps, settings or files depending on the option. Back up personal files cautiously and avoid restoring an unknown program from the same period. For a work or school device, let its administrators decide the recovery method. If personal safety is involved, plan changes from a safe place and device; abrupt account or device changes can be visible to someone else.¶

Imagine an email claiming an expensive support subscription renewed. You call the number in the message. The “agent” asks you to install a remote tool so they can process a refund. They open a banking page while controlling the laptop, then say the refund was too large and demand a transfer to correct it. This is an example, not a reported incident.¶

The practical response is to end the remote session and disconnect the laptop. From a separate phone, call the bank using a known number and ask it to verify transactions and protect the account. Record the email, call time, remote-tool name and any payment reference. Change exposed account credentials from the phone, review sessions, then investigate the laptop. Do not send back a supposed overpayment based on a screen the caller controlled. The bank can tell you whether any actual credit occurred.¶

This example also shows why the exact sequence matters. A scan might take time while a payment is still pending. A password change on the controlled laptop might expose the replacement. A bank call from a separate device addresses the financial risk without trusting the compromised screen.¶

Report the incident to the bank or payment service if money or financial details were involved. Report the scam to your country's official cybercrime, consumer-protection or police channel where appropriate. The United States, Australia and other countries have different forms and processes, so choose the authority for where you live. Give a factual timeline and the evidence you kept. Reporting can help an investigation, but it does not guarantee recovery.¶

Be careful with follow-up calls. Someone may claim to be from a bank, a technology company or an investigation team and ask for another remote session, a code, or a “recovery fee.” End the call and contact the organisation through a number or app you obtained independently. Genuine technical help should be arranged through a provider or person you chose, not a phone number in a warning or a caller who pressures you to act immediately.¶

After the urgent work, review account alerts and statements for unexpected activity. Tell a trusted family member if they can help you track calls and tasks. There is no shame in asking for help: these scams are designed to make a confusing screen and an urgent voice seem authoritative. The useful question now is what access was granted and what still needs securing.¶