What to Do If a Tech Support Scammer Got Remote Access to Your Computer

If a caller, pop-up, or online stranger persuaded you to let them control your computer, you can still take useful steps to limit the damage. The priority is to stop their access, protect your accounts from a separate device, and check the computer before you use it for sensitive tasks again.

This guide is for people who gave someone remote access or installed a remote-control app at their request. You do not need to know exactly what the person did before you begin.

What to do first

1. End the contact. Close the call or chat. Don’t follow more instructions, call a number the person gives you, or pay for “repairs” or “refunds.” A legitimate company should not need you to stay on the line with a stranger to undo the incident.
2. Disconnect the affected computer from the internet. Turn off Wi-Fi or unplug its network cable. If you can’t disconnect it, shut it down. Don’t use that computer to sign in to email, banking, shopping, or other important accounts while you work through the next steps.
3. Switch to a different, trusted device. Use a device the scammer did not control, such as another computer or your phone, if it was not part of the remote session. If you’re unsure whether another device is safe, use a trusted person’s device or contact your bank by phone using the number on your card or official statement.

Protect your money and accounts

1. Contact your bank or card company if financial information was exposed. Tell them what happened and ask whether they recommend freezing a card, changing account access, or watching for particular transactions. If you sent money, contact the provider you used as soon as possible and ask whether the transaction can be stopped or reversed. Recovery is not guaranteed, but quick contact may help.
2. Change important passwords from the trusted device. Start with the email account used to reset other passwords, then change passwords for financial accounts and any account whose password you shared or reused. Choose new, unique passwords. Don’t enter them on the computer that was remotely controlled.
3. Review account access and sign out unfamiliar sessions. Look for devices, sign-ins, recovery addresses, or phone numbers you don’t recognize in each important account’s security settings. Remove unfamiliar access and turn on multifactor authentication where available. This asks for an additional verification step when you sign in. For a Google account, for example, Google’s account settings let you review devices connected to the account.

Check the computer before using it again

1. Get help removing remote-access software. If you know the name of the app the caller asked you to install, tell a trusted technician or the computer’s manufacturer. If you are comfortable doing it, remove the app through the computer’s normal app or program settings. Don’t reopen it or follow directions from the caller. Removing one app does not prove that nothing else was changed.
2. Update the computer’s security software and run a scan. Once you’re ready to reconnect, use the operating system’s built-in security tools or security software you already trust. Update it and run a full scan, following its instructions if it finds something. The Federal Trade Commission recommends updating security software and scanning after a tech support scam. If you’re unsure what a result means, ask a trusted technician rather than accepting help from a pop-up or unsolicited caller.
3. Ask whether a deeper cleanup is needed. If the scan finds malware, the computer behaves strangely, or you can’t confidently remove the remote-access tool, leave it offline and get help from a reputable repair professional or the device maker. A professional may recommend reinstalling the operating system, but don’t erase the computer or restore a backup as a first reaction. Get advice about preserving important files and avoiding a backup that could bring unwanted software back.

Things to know

• Keep evidence. Save emails, texts, phone numbers, receipts, and screenshots of pop-ups if you can do so safely. Don’t keep interacting with the scammer to collect more.
• Report the incident. In the United States, you can report a tech support scam to the FTC at ReportFraud.ftc.gov. If money or identity information was involved, tell the relevant financial institution and ask what further steps it recommends.
• Be wary of a second offer to help. Scammers sometimes contact people again claiming they can recover money or finish the cleanup for a fee. Don’t give them remote access or payment details.

You don’t have to diagnose the computer on your own. Disconnect it, secure your accounts from a trusted device, contact your financial institution if needed, and get reliable help with the cleanup. Taking those steps in order can give you a safer path back to normal use.