What to do if you gave a scammer remote access to your computer
It usually begins with a pop-up warning that your computer is infected and a number to call, or a phone call from someone claiming to be Microsoft, your bank, or Amazon. They talk you through installing a program so they can “fix” the problem. Once they have control of your screen they open a few windows that look alarming, and by the end you have either paid for something or sat there watching them page through your files. Now the call is done and you are trying to work out what they actually got.
Here is the reassuring part, and I mean it as an investigator, not as comfort: how much this ends up costing you depends far more on the next hour than on what already happened. The steps that contain the damage take only a few minutes each, and they work in a particular order.
Disconnect the computer right now
Pull it off the internet first. Unplug the network cable, switch off the Wi-Fi, or hold the power button until the machine shuts down. While they have a live connection they can keep working, so cutting it ends the session and stops the remote tool from phoning home. Leave the computer off until you have a plan to clean it.
Change your passwords from a different device
Use your phone or another computer the scammer never touched, not the one they were inside. Start with email, then your bank, then anything that shares that password. Email comes first because it is the master key, the thing that resets all the others. Turn on two-factor authentication while you are there. If you bank online, call the number on the back of your card and tell them a scammer had access to your device.
If money moved, treat it as urgent
Some of these end with a “refund” made too large on purpose, then pressure to send back the difference in gift cards or crypto. Others end with a flat charge for fake services. Either way, call your bank or card issuer now, say the word fraud, and ask about a chargeback or a wire recall. The first hours are when a payment can still be stopped. If you bought gift cards, call the issuer, read them the numbers, and ask them to freeze the balance. If you sent crypto, save the transaction hash and the wallet address before anything else. It will not reverse, but that record is what a tracer follows later. Our guide to preserving evidence in the first 24 hours covers what to keep.
Watch for the call that comes next
A week or two later the phone rings again. This time it is a “fraud investigator,” someone from your “bank,” or a supposed government agent, and the message is that your accounts have been compromised and you must move your money into a safe account to protect it. It is the same crew, or someone who bought your details from them, and they are counting on you being rattled enough to trust a rescuer. The FBI has a name for this two-stage version, the phantom hacker scam, and the second call is where the far bigger money tends to go. No genuine bank or agency ever asks you to move your savings to keep it safe. When you hear that, hang up and dial back on a number you find yourself, off a statement or the back of your card.
Report it, then clean the machine
File with ReportFraud.ftc.gov, and if personal information was exposed, start a recovery plan at IdentityTheft.gov. Older adults get hit hardest by these. The FTC counted about $159 million in reported tech-support losses in a single year, and the real number runs higher because most people are too embarrassed to report it. You have nothing to be embarrassed about. Before you trust the computer again, have someone reputable wipe and reload it, or run a full security scan and remove any remote-access tools they added, with names like AnyDesk, TeamViewer, or UltraViewer.
Can anyone find out who did this? An honest read
People ask me this the moment the shock wears off, so I will be straight about it. The crews running tech-support and phantom-hacker scams are, in the large majority of cases, organized operations working out of call centers overseas. Naming a specific individual behind one of them, to the point where someone gets arrested, is genuinely rare, and anyone who promises you otherwise for a fee is usually the next scam in line. What open-source work and forensic tracing can realistically do is different but not nothing: document the money trail in a form a bank or insurer will act on, follow crypto across the chain to the exchange where it cashed out, and occasionally reach that exchange in time to matter. When a retirement account has been drained, or real money pushed through a chain of transfers you need documented for a claim, that documentation is worth having even when a name never comes with it.
Our Investigation Help page covers the smaller cases we take on directly, and for court-grade attribution we route to Rexxfield. None of it guarantees the money comes back. What it does is keep the trail from going cold while it can still be followed.
One habit worth keeping from today: no real company calls out of the blue asking to remote into your computer. Microsoft doesn’t. Your bank doesn’t. The moment someone asks for that access, the answer is no, and you hang up.
— Lisa, GCCI