Key takeaways

Never let anyone who contacted you take control of your computer or phone. Microsoft says it will not call you to offer tech support unless you contacted it first, and the FTC says real security pop-ups never ask you to call a number.

  • With remote access, a scammer can see your screen, reach your files, and watch you log in to your bank.
  • The FTC says a fake technician may pass you to a fake “government official” or “bank fraud team” who tells you to move your money.
  • If you gave access, disconnect, call your bank on a number you already trust, remove the software, and change passwords from a different device.

Got a name, website, or phone number from the caller? Check the scam directory.

How a remote access scam works

Scamwatch describes the setup plainly. Scammers pose as a telecommunications provider, computer company, or tech support service, claim your device has a problem, and push you to buy software or a service to fix it. They then ask for remote access so they can supposedly diagnose the issue. Once connected, they can view and control your screen, reach your files, and use open apps, and they may try to get your personal, bank, or card details.

The contact usually starts one of three ways, according to the FTC: a fake pop-up warning that looks like it comes from a well-known company and urges you to call a number, a call or text from someone posing as a computer technician, or a scam site or ad that reaches the top of your search for tech support. In every case the first move is to make you contact them or let them in.

This guide focuses on the remote access step. For the wider family of pop-up and cold-call scams, see tech support scams and vishing and callback phone scams.

Three patterns, with detail

1. The pop-up that says call us

The FTC’s 2024 alert describes a newer version of the old virus pop-up. The screen warns that someone has hacked your bank, investment, or retirement account and gives a number. The person who answers transfers you to someone posing as the FTC, the FBI, or your bank’s fraud team. That second person says the only way to protect your money is to move it to a new account. The FTC says the scammer controls that account and drains it, or asks you to buy gift cards or bitcoin, or to withdraw cash or buy gold and hand it over in person. The FTC’s advice is blunt: never call a number from a security pop-up, never move money to “protect” it, and never share a verification code.

2. The email flood followed by a helpful call

In May 2024 Microsoft published research on a financially motivated group it tracks as Storm-1811, known for deploying Black Basta ransomware. Microsoft said the group signed targets up to many email subscription services to flood their inboxes, then called while posing as IT or help desk staff offering to fix the “spam problem”. By late May 2024 the group also used Microsoft Teams messages and calls from attacker-created tenants with names like “Help Desk”. Victims were persuaded to enter a security code in Quick Assist, approve screen sharing, and grant remote control. Microsoft said follow-on activity included downloading payloads and credential-stealing steps. This is the business version of the scam, but the same script is used against individuals: create a problem, then offer the fix.

3. The renewal notice and the “refund”

The FTC describes messages about a charge for a tech support subscription, often using the names of well-known brands, telling you to call within 24 hours. The caller asks for remote access or bank details through a spoofed site, then claims you were overrefunded and asks you to pay back the difference. Scambaba advice: never judge a refund by what a screen shows while someone else has access to it. Your bank’s own app or statement, opened on a clean device, is the record that counts.

Eight warning signs

  1. An unexpected contact about a problem with your device. Scamwatch says scammers pose as a telecommunications provider, computer company, or tech support service and claim your device has a problem. Microsoft says it will not call you to offer tech support unless you contacted it first.
  2. A request to install a tool or read out a code. Scamwatch says scammers ask for remote access so they can supposedly diagnose the issue. Microsoft says to allow a helper in only if you started the contact with Microsoft Support or your IT staff.
  3. A pop-up with a phone number to call. The FTC says real security pop-up warnings never ask you to call a phone number. Microsoft says real error messages from big tech companies do not include phone numbers either.
  4. A sudden flood of spam, followed by a call from “IT”. Microsoft described a group that signed targets up to many email subscriptions, then phoned offering to fix the “spam problem”, then asked them to open Quick Assist.
  5. A transfer to a “government official” or “bank fraud team”. The FTC says a fake technician may hand you to someone posing as a government official who says your accounts were hacked and asks you to move your money to “protect” it.
  6. A fee, refund, or renewal charge you did not expect. The FTC describes fake renewal notices for tech support subscriptions that tell you to call within 24 hours, then claim you were overrefunded and ask you to pay back the “difference”.
  7. A demand for gift cards, transfers, crypto, or cash. The FTC lists gift cards, wire and bank transfers, cryptocurrency, and payment apps as scam payment methods. See gift card scams and bank transfer scams.
  8. Pressure not to hang up or tell anyone. Scambaba advice: keeping you on the line stops you thinking and stops anyone checking. A real company will let you hang up and call back on a number you find yourself.

How to check a “support” contact in two minutes

  1. Ask who started it. If you did not contact them first, treat it as unsolicited. Microsoft’s rule is that it will not call you to offer tech support unless you contacted it first.
  2. Do not call the number on a pop-up. If you think there is a real problem, the FTC says to update your security software and run a scan, or get help from a company you already know, or a local computer store.
  3. Do not read out any code, press any approve button, or open any remote tool because someone told you to. Quick Assist and similar tools are genuine; the danger is who is on the other end.
  4. Hang up and look up the company’s number yourself, from a statement or the official website you typed in.
  5. Talk to someone you trust before acting, as the FTC suggests. A five minute pause removes most of the pressure the scam depends on.

If you already gave them access: a step-by-step plan

Work through this in order. The steps combine Scamwatch’s remote access guidance, the FTC’s “what to do if you were scammed” page, and Microsoft’s advice to disconnect and report a suspicious session.

  1. Disconnect now. End the session by closing the remote tool, then turn off Wi-Fi or unplug the network cable. Microsoft advises disconnecting immediately if a session looks malicious. This stops further activity while you work.
  2. Call your bank or card provider from a different phone or a number you already trust. Say you let someone remotely access your device while you were logged in, report the scam, and ask them to stop transactions. Scamwatch gives the same first step.
  3. If you paid, follow the payment-specific steps on the FTC’s what to do if you were scammed page: card issuer for cards, the wire company for wires, the gift card issuer for gift cards (keep the card and receipt), and the app for payment apps.
  4. Do not move money to a “safe” account, whatever you were told on the call. Only the scammer tells you to do this.
  5. Remove the remote access software. Scamwatch says to remove it and run antivirus to check for other malware, since scammers may leave a back door. On Windows, you can use Settings, then Apps, then Installed apps to uninstall a program you did not install on purpose.
  6. Update your security software and run a full scan, deleting anything it flags. The FTC gives this step, and says to contact the device manufacturer or a trusted technician if you need help removing malware.
  7. Change your passwords from a different, clean device, starting with email, banking, and any government or shopping accounts. Turn on two-factor authentication. If you reused a password, change it everywhere.
  8. If you can no longer log in to an account, use that service’s account recovery steps. See SIM swap and account takeover scams.
  9. If you shared ID details or a Social Security number, use identity support where you live. In the United States the FTC points to IdentityTheft.gov. In Australia and New Zealand, IDCARE (1800 595 160 in Australia) offers free help.
  10. Keep evidence. Save phone numbers, screenshots, emails, and receipts. Do not delete anything that might help a report.
  11. Report it, using the list below, once your details are secure.
  12. Do not pay a “recovery” service. Calls offering to get your money back are a known second scam. See recovery scams.

Where to report

How to protect yourself and your family

  • Agree a family rule: nobody lets a caller control a device without first calling the person they trust most.
  • Remove remote tools you do not use. Microsoft recommends blocking or uninstalling Quick Assist and other remote management tools that are not needed.
  • Keep antivirus, anti-spyware, and firewall protection up to date, and buy software only from reputable sources, as Scamwatch advises.
  • Use multi-factor authentication where possible, and choose strong passwords or passphrases, as Scamwatch advises.
  • Do not open attachments or click links unless you trust the sender. CISA gives the same advice on social engineering and phishing.

More help from official sources

Scambaba is an independent educational project. Reporting and recovery options depend on where you live. Items marked as Scambaba advice are practical suggestions, not quotations from an agency. How these guides are researched is on the editorial policy.

Frequently asked questions

What can a scammer do once they have remote access?

Scamwatch says that once connected they can view and control your screen, reach your files, and use open apps, and may try to get your personal, bank, or card details. They can also leave a back door for later access, which is why Scamwatch advises removing the remote access software and running antivirus afterwards.

Are tools like Quick Assist, AnyDesk, or TeamViewer scams?

No. They are legitimate tools used every day by IT teams and families. The problem is who asks you to run them. In its 2024 write-up Microsoft recommended blocking or uninstalling remote management tools that are not needed, and using one only when you started the contact with Microsoft Support or your own IT staff.

The caller knew my name and my bank. Doesn’t that prove they are real?

No. Scammers buy or collect personal details from data leaks and public sources. Knowing your name, address, or provider is not proof of anything. The FTC’s test is simpler: legitimate tech companies do not contact you by phone, email, or text about your computer.

I already read out the code and they took control. What is the first thing to do?

Disconnect the device from the internet (turn off Wi-Fi or unplug the cable), end the session by closing the remote tool, then call your bank from a different phone using a number you already trust. After that, follow the step-by-step plan below.

Will uninstalling the program remove the scammer’s access?

It removes that route, but Scamwatch warns scammers may leave a back door for later access. Remove the software, update your security software and run a scan, and consider asking the device maker or a trusted technician to check the machine. Change passwords from a different, clean device.

They said I was refunded too much and must send money back. Is that real?

The FTC describes this as a known pattern: after taking bank or card details through a spoofed page, the scammer claims you were overrefunded and asks you to pay back the difference. A real refund does not require you to send money anywhere. Contact your bank directly.

Can I get my money back?

Sometimes. Speed matters. The FTC says to contact your card issuer, bank, or payment app immediately, tell them you were tricked, and ask for a reversal. Money sent by gift card, cryptocurrency, or wire is harder to recover, but ask anyway and report it.