What to Do After Giving a Scammer Remote Access
You let a scammer connect to your computer or phone. What to do right now: disconnect, remove the software, secure your accounts from another device, and check your banking.
You installed an app, read out a code, and a "technician" or "bank agent" connected to your device. Now you realise it was a scam. Do not panic, and do not wait. The steps below, in this order, limit what the scammer can do with the access they had.
Start with step 1 now. If money may be moving, do step 3 at the same time from another phone.
Step 1: Disconnect
- Hang up if you are still on the phone.
- Disconnect the device from the internet: switch off Wi-Fi and mobile data, or unplug the network cable.
- Leave the device switched on for now if you plan to get it checked, but do not use it for banking or email.
Step 2: Remove the software
- Computer: uninstall the remote access program through your system's apps or programs list. Look for any other programs installed at the same time and remove those too.
- Phone: uninstall the app, and check settings for accessibility permissions, device admin rights or screen recording permissions you granted during the call.
- Browser: remove extensions you did not add.
- Run a full scan with reputable security software.
Step 3: Protect your money
- Call your bank on the number from your card, using a different phone if possible. Explain that a scammer had remote access and ask them to check for transfers, new payees and changed details, and to secure your accounts.
- Block cards whose details were visible or typed during the session.
- Contact any payment app or crypto exchange you used or opened.
Our guide on what to tell your bank after a scam has a call script.
Step 4: Secure your accounts from a different device
- Email first: change the password and turn on two-step verification.
- Banking and payment accounts.
- Any account you logged in to during the session, or whose password was saved in the browser.
- Sign out of all sessions and remove unfamiliar devices.
Step 5: Check the device
If you are not confident that everything has been removed, or you notice strange behaviour such as the mouse moving or new programs appearing, get the device checked by a trusted technician, or back up your personal files and reset it to factory settings.
Step 6: Report and watch
- Report the scam to your national fraud service. See how to report a scam.
- Watch your statements and email for weeks afterwards.
- Expect follow-up calls, especially "refund" offers. See refund scams.
- If identity documents were on the device, consider a credit freeze or fraud alert where available.
What they may have seen or done
| Risk | What to do |
|---|---|
| Watched you log in to your bank | Call the bank, change passwords, check payees. |
| Opened files and photos | Consider what was stored: ID scans, passwords, tax documents. |
| Saw codes arrive | Check the accounts those codes belonged to. |
| Installed other software | Scan, remove, and consider a reset. |
Want to check a follow-up message? Paste it into CyberWatch AI Scan for a free check.
To avoid this in future, read remote access app scams. For the bigger picture of how online scams work, read our complete guide.
Frequently asked questions
Can the scammer still access my computer after I hang up?
Possibly, if the remote access software is still installed and running, or if they installed other tools. Disconnect from the internet and remove the software straight away.
Should I wipe my computer?
If you cannot confirm that all unwanted software has been removed, or you see continuing strange behaviour, a professional clean-up or a full reset after backing up your files is the safest option.
Do I need to change all my passwords?
Change passwords for any account you logged in to, or that was saved in the browser, starting with email and banking. Do it from a different, trusted device.
Sources
- How To Spot, Avoid, and Report Tech Support Scams, US Federal Trade Commission
- Malware: How To Protect Against, Detect, and Remove It, US Federal Trade Commission
- Recovering a hacked account, UK National Cyber Security Centre
