A Scammer Had Remote Access to Your Computer: The First Hour
You called the number on the popup, or they called you, and someone spent twenty minutes clicking around your computer. It happens to careful people every day. What you do in the next hour decides how much it costs.
If you read nothing else, do two things: get that computer off the internet, and call your bank from a different phone or device. Everything below is the detail, in the order it matters.
These callers are after money, not your computer. The remote connection is how they see your accounts, stage a convincing story and keep you on the line. So the first hour is about cutting the connection and protecting the money. Cleaning up the computer comes after that, and it can wait until the urgent calls are made.
The First Hour, In Order
End the connection now
Hang up. Don’t explain, don’t argue, and don’t wait for them to finish. Then take the computer offline: unplug the network cable, turn off Wi-Fi, or hold the power button until it shuts off. If the screen is locked or covered by a message, the power button still works.
Switch to a different device
Everything from here on happens on a phone, a tablet or another computer the caller never touched. Don’t turn the affected computer back on to look something up.
Call your bank and card companies
Use the number printed on the card or statement. Tell them someone had remote access to your computer and may have seen your accounts. If you signed in to online banking while they were connected, say so, and ask them to review recent transfers, including transfers between your own accounts, and to reset your online banking login.
If you paid them, call whoever moved the money
Card, gift card, wire, payment app and cryptocurrency each have a different call to make, and minutes matter. The table below has the list.
Change your email password, then banking, then the rest
Email goes first because it resets everything else. Assume any password saved in that computer’s browser was seen. Do this from the other device, and make each one new and unique. Your Password Was in a Breach has the full order.
Sign out everywhere and add a second factor
Google, Microsoft, Apple and Facebook all have a “sign out of all sessions” button under security. Use it, then turn on a passkey or an authenticator app for your email account. See Passkeys, Explained.
Write it all down while it is fresh
The number you called or that called you, the names they used, the times, what they had you install or type, the amounts, and any gift card numbers and receipts. Your bank and the fraud reports will ask for it.
Leave the computer off until it has been checked
Remote access programs are often set to reconnect on their own. Until someone has confirmed what was installed and removed it, the computer stays off, and it is not used for banking.
Report it
File at ReportFraud.ftc.gov and at ic3.gov, the FBI’s Internet Crime Complaint Center. If you are 60 or older, the National Elder Fraud Hotline is 833-372-8311. A report rarely gets money back by itself, but a report number can help with a bank dispute.
Freeze your credit if you gave them personal details
A Social Security number, a driver’s license or a Medicare number is enough to open accounts in your name. A freeze at Equifax, Experian and TransUnion is free and takes about ten minutes each.
If You Paid Them: Who To Call
How you paid decides who can still stop it. Make the call now, even if it feels too late.
| How you paid | Who to call, and what to ask for |
|---|---|
| Credit or debit card | The card company, using the number on the card. Dispute the charge as fraud and ask for a new card number. |
| Gift cards | The company named on the back of the card (Apple, Google Play, Target and so on), right away, with the card and the receipt in hand. If the money has not been spent yet, they can sometimes freeze it. Keep the cards and the receipt. |
| Wire transfer | Your bank’s fraud line, or the wire company (Western Union, MoneyGram). Ask them to recall the wire. |
| Zelle, Venmo, Cash App or a bank transfer | Report it inside the app as fraud, then call your bank and report it there too. |
| Cryptocurrency or a Bitcoin ATM | Report it to the exchange or the ATM operator, and file at ic3.gov. This money is rarely recovered, but the report still matters. |
| Cash or a check in the mail | The carrier (USPS, UPS or FedEx), to try to intercept the package. For a check, ask your bank to stop payment. |
What They Were Actually Doing
It helps to know the script, because it explains what to check. The caller usually opens something that looks alarming but is completely normal, such as the Windows event log or a command window full of scrolling text, and calls it proof of an infection. Then comes the remote access program, “so the technician can fix it.”
The expensive version is the refund. They ask you to sign in to your bank so they can “process your refund,” blank your screen for a moment, and either move money between your own accounts or change what the page displays. Now it looks like they refunded you far too much, the caller is panicking about losing their job, and the only way to fix it is gift cards or a wire, today. The extra money was yours the whole time. Nothing was ever refunded.
What They Leave Behind
Most often, a remote access program such as AnyDesk, TeamViewer, UltraViewer or ScreenConnect, set up so they can reconnect without anyone clicking “allow.” These are legitimate tools, the same kind real technicians use, including us. The tool is not the problem. The person on the other end is.
Less often: a changed Windows password or a lock message (leverage, in case you stop cooperating), a fake “security” program, a browser extension, or a new user account. Real malware is the least common, but it cannot be ruled out from the outside, which is why the computer stays off until someone has looked.
Do You Need To Wipe the Computer?
Usually not. A proper check removes the remote access tools, reviews startup items, scheduled tasks, user accounts and browser extensions, runs full scans, and confirms nothing is set to reconnect. In most cases that is done without reinstalling Windows, so your files, settings and programs stay where they are. See our virus and spyware removal page for how we approach it.
A full wipe makes sense when they had long unattended access, or when something turns up that cannot be accounted for. Either way, make sure your photos and documents are backed up first. Our home backup guide covers how.
Expect a Second Call
They will probably call back. Sometimes angry, sometimes apologetic, sometimes as a brand new “refund department,” your bank’s “fraud team,” or a government agency offering to recover what you lost for a fee. It is the same people, or people who bought your number from them. No legitimate agency or company charges an upfront fee to recover money, and the real ones do not cold call you about it.
Your number is on a list now, so expect more scam calls for a while. Let unknown numbers go to voicemail.
What Not To Do
- Turn the computer back on “just to check.”
- Call the number back, even to tell them what you think of them.
- Pay anyone who promises to recover the money.
- Search for a “Microsoft support number” to get it fixed. That search is how many people find the next scammer. See the fake virus popup guide.
- Put off calling the bank because you are embarrassed. They take this call all day, and the hour matters more than the story.
If It’s a Work Computer
Tell whoever handles your IT the same hour. An office computer usually has saved sign-ins for company email, shared files, and sometimes accounting or payroll, and a stranger with access to a work mailbox is how fake invoice and wire fraud cases begin. It is a much smaller problem on day one than on day thirty.
This Happens to Careful People
These are professional operations with scripts, training and quotas, and they are good at it. Being fooled by one says nothing about your intelligence. Tell your family what happened, partly so they can help and partly because they are likely to get the same call. If you are reading this on behalf of a parent, our guide to helping a parent with their computer covers the one family rule that stops most of these, and our computer help for seniors page explains how we work with older clients.
Quick Self-Check
| Question | If “no” or “not sure”... |
|---|---|
| Is the computer off, or at least off the internet? | Do that first |
| Has the bank been called from a different phone? | Call now, number on the card |
| Has the email password been changed from another device? | That is next |
| Do you know exactly what they installed? | Leave it off and have it checked |
Want It Checked Before You Turn It Back On?
A technician can come to you, or we can pick the computer up and return it. We remove whatever was installed, check for anything set to reconnect, and tell you plainly whether the machine is safe for banking again. Standard rates apply: $125 an hour for home computers, with a one-hour minimum on-site. Call from a phone, not from that computer.
Frequently Asked Questions
Can the scammer still get into my computer after I hang up?
Possibly. The remote access program they had you install is often set up to reconnect without anyone approving it. That is why the computer should stay off, or at least off the internet, until someone has confirmed what was installed and removed it.
Do I need to wipe my computer after a scammer had remote access?
Usually not. In most cases the remote access tools and anything else they added can be found and removed without reinstalling Windows, and your files, settings and programs stay where they are. A full wipe makes sense when they had long unattended access, or when something turns up that cannot be accounted for. Either way, back up your photos and documents first.
Can I get my money back?
It depends on how you paid and how fast you act. Credit card charges can usually be disputed. Gift cards can sometimes be frozen if you call the company on the back of the card before the money is spent. Wire transfers and payment apps are harder, and cryptocurrency is rarely recovered. Make the call within the hour either way, because every one of these gets worse with time.
They had me sign in to my bank while they were connected. What now?
Call the bank’s fraud line now, from a different phone, using the number on your card. A common trick is to move money between your own accounts, or edit what the page shows, so it looks like they refunded you too much, then ask you to send the difference back. That extra money was yours all along. Ask the bank to review recent transfers and to reset your online banking login.
Someone called offering to recover the money I lost. Is that real?
No. That is a second scam aimed at people who were just scammed, often run by the same group. No legitimate agency or company charges an upfront fee to recover lost money, and the real ones do not cold call you about it.
Related guides
The first hour after a breach notice: what to change, in what order, and what to check.
Lock it, protect the accounts on it, and suspend the line, in the right order.
Getting the fake Microsoft alert off your screen without calling the number.
The proactive steps that keep your business off the list of ransomware victims.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service