A caller said they were from your bank, your internet provider or a software company, and asked you to install a program so they could “fix” something. You did. Now you suspect they were not who they claimed. This page is about the next hour: cutting access, protecting money, and cleaning up. How the scam is staged is covered in Fake Customer Care Numbers.
Immediate Steps (First 15 Minutes)
- Cut the connection. Disconnect from the internet. If the session is still open, close the remote-access window and shut the computer or phone down if you can. Do not try to confront or “trace” the caller.
- Assume anything visible was seen. Anything on screen during the session may have been viewed or recorded: passwords typed, banking pages opened, emails read. Treat accounts you opened as exposed.
- Use a different device for the urgent calls. On a phone or computer the scammer never touched, call your bank using the number on your card or the official app. Say you gave a stranger remote access. Ask about freezing cards and online access, stopping pending transfers and a recall of any payment.
- Change passwords from the clean device. Start with your email, then banking, payment apps, cloud storage and social accounts. Sign out other sessions and turn on stronger two-factor authentication. See Account Hacked? What to Do, Step by Step.
- Check for payments you didn’t make. Review banking and wallet activity, including small test transfers and new payees. Scammers often move money between your own accounts to stage a fake “refund.”
Cleaning the Device
Windows or Mac computer
- Uninstall remote-access tools you don’t recognise or didn’t knowingly install. Common ones include AnyDesk, TeamViewer, Quick Assist, UltraViewer and similar; also check for unfamiliar programs installed around the time of the call.
- Review startup items, browser extensions and any new user accounts, and remove what you didn’t add.
- Run a full scan with a reputable security product. On Windows, an offline scan in Microsoft Defender can help find persistent malware.
- If you can’t be sure it’s clean, back up documents and photos only, then reset the operating system from official recovery options and reinstall programs from trusted sources.
Android or iPhone
Uninstall the remote-support app, review special permissions (Accessibility, Device admin, Display over other apps on Android, and configuration profiles on iPhone), run Play Protect on Android, and reset the device if symptoms continue. Detailed steps are in What to Do If You Installed a Suspicious App.
What the Caller May Have Done During the Session
- Opened your banking site while the screen was hidden or dimmed, and moved money or added a payee
- Installed a second tool that stays hidden so they can return
- Read or copied saved passwords, browser data, emails and documents
- Staged a fake refund to make you send money back — sometimes using the banking page to make an “overpayment” appear
- Changed settings such as email forwarding or recovery phone numbers
Helen sees a pop-up saying her computer is infected and calls the number on it. The “technician” asks her to install a remote-support tool, then says her bank account has been compromised and asks her to log in so he can “check.”
When he says a $3,000 refund was sent by mistake and she must return it, Helen becomes suspicious. She unplugs the router, uses her husband’s phone to call the number on her bank card, and asks the bank to block the account and any transfers. At home she uninstalls the tool, changes her email and bank passwords from the phone, and scans the computer.
What mattered: she disconnected first, then used a separate device and an official number.
Reporting and Recovery
Report to the bank immediately and to your national authority (cybercrime.gov.in and 1930 in India, reportfraud.ftc.gov and ic3.gov in the United States). Write down the phone number that contacted you or that you called, the program you installed, the time of the session and what you opened. For what to save, see how to preserve evidence after an online scam, and for overall steps, Been Scammed? What to Do in the First Hour.
Afterwards, expect more calls. Scammers often return pretending to be your bank, police or a “refund department” offering to fix it. The Scam After the Scam explains this second wave. Never pay for cleanup or recovery, and never let anyone remote into your device again unless you started the support request through an official channel.
Key Takeaways
- Disconnect first, then use a different device to call the bank and change passwords.
- Assume anything you opened during the session was seen.
- Remove remote tools, scan or reset the device, and check for hidden changes.
- Report, keep records and ignore follow-up “recovery” offers.
Related topics:
Fake Customer Care NumbersInstalled a Suspicious App?Account Hacked?What to Do After a ScamAsked to install a “support” tool?
Paste the message or a screenshot into ScamSense for a risk assessment before you install anything. It is an extra check, not a guarantee.
Start 3-Day Free TrialFrequently Asked Questions
What is the first thing to do after giving someone remote access?
Will uninstalling the remote-access app remove the scammer?
Should I change my passwords from the same computer?
The caller said they sent me a refund by mistake. What do I do?
Do I need to reset the computer?
Note: This guide is general information, not legal or financial advice. Procedures, deadlines and refund rights differ by country, bank and payment method. Always use contact details from your bank’s official app, website or the back of your card. ScamSense helps you assess suspicious content but cannot guarantee that any message, link or caller is safe or unsafe.