A remote access scam is social engineering that persuades you to let an impostor view or control your computer or phone. Remote support software can be legitimate; the scam lies in the caller's identity, the invented problem, the excessive permissions, and requests to open a bank account, reveal codes, or move money.

Key Takeaways

Legitimate remote support begins through a channel you independently trust and stays within a clearly explained task.

A bank, government agency, or support technician should not need you to hide the screen, move money, buy gift cards, or read out a one-time code.

Ending a session, uninstalling persistent software, recovering accounts, and disputing a payment are different response branches.

Protect accounts from another trusted device; do not log in to banking on a computer the scammer may still control.

Use the online security guide for broader prevention. This page concentrates on the authorization boundary created by remote control.

How does a remote access scam work?

The scammer invents authority and urgency. They may impersonate technical support, a bank, a retailer processing a refund, a government office, or a fraud investigator. Contact may arrive by phone, advertisement, email, text, pop-up, or a number displayed by a fake virus alert.

Next, the person asks you to install or open a real remote support tool and share a session code. The FTC warns that tech-support scammers use remote access to diagnose fabricated problems, install unwanted software, or obtain payment.［1］ The tool's legitimacy does not authenticate the operator.

Once connected, the scammer may move the pointer, open system utilities, hide parts of the screen, copy files, install persistent access, or direct you to online banking. The FBI has described schemes in which criminals use remote desktop software and persuade victims to log in to financial accounts or make transfers under a false refund or security story.［2］

How can you verify a remote support scam before connecting?

Pause before installing anything or sharing a code. A real problem will still exist after you end the contact and verify it independently.

Verification question	Safer support boundary	Remote access warning sign
Who initiated contact?	You contacted an organization through its known app, site, or number	An unexpected caller or pop-up claims an urgent problem
How was identity verified?	You independently reopened the official channel and found the same case	The caller supplies the only number, link, or case portal
What access is needed?	The technician explains the task, scope, duration, and how to end the session	They demand full control before explaining the issue
What happens on screen?	You can see the work and keep control	The screen is blacked out, minimized, or you are told not to watch
Are financial accounts involved?	Support never asks you to log in to banking for diagnosis	You are told to check a balance, accept a refund, add a payee, or transfer funds
Is payment requested?	Fees, if any, are shown through the organization's normal billing process	Gift cards, cryptocurrency, cash, wire transfers, or a “safe account” are demanded

Do not trust caller ID, a top search result, or a logo in the tool. Type the organization's address yourself or use a number printed on a card or statement. If the caller objects to independent verification, end the contact.

Which remote control software requests are unsafe?

Treat any request to log in to a bank, payment service, cryptocurrency exchange, primary email, password manager, or government account during the session as a critical red flag. A legitimate computer technician does not need to see your bank balance to remove malware or process an ordinary support case.

Refuse requests to disable security software, approve administrator rights without a clear reason, install unattended access, reveal one-time codes, or conceal the session from a bank employee or family member. Microsoft notes that genuine Microsoft error and warning messages do not include phone numbers and advises users not to give unsolicited callers control of a device.［3］

Also be wary of “refund” arithmetic. A scammer may alter a page or hide the screen to make a credit appear real. Verify balances in the official app from another trusted device or by contacting the institution directly.

What should you do during a remote support scam?

If you recognize the scam while connected, stop cooperating. Do not argue, announce every recovery step, or continue the session to gather more evidence.

End the remote session using the tool's disconnect control if you still control the device.
Disconnect Wi-Fi or Ethernet if the pointer keeps moving or the session will not close.
Power down the device if you cannot reliably disconnect it.
From another trusted device, contact any financial institution involved and protect important accounts.
Preserve the caller number, messages, payment receipt, remote-tool name, session time, and case details you already have.

Do not remain connected while calling the bank. The scammer may see the number, read messages, capture new credentials, or interfere with the conversation.

Which remote access recovery steps match your exposure?

Classify what actually occurred. Use a higher level if the boundary is uncertain.

Exposure level	What happened	Required response
Session started only	A temporary view/control session began; no persistent tool, sensitive login, or payment	End connection, restart, review permissions and recent activity, and monitor
Persistent tool installed	Unattended access, startup permission, profile, account, or remote software may remain	Disconnect, secure accounts elsewhere, remove persistence, update, scan, and assess rebuild need
Sensitive account used	You logged in, typed a password, displayed codes, or opened private files	Treat visible credentials, sessions, and data as exposed; recover from a trusted device
Payment or transfer made	Money, card details, gift cards, cryptocurrency, or bank changes were involved	Contact the financial provider immediately, attempt dispute or reversal, preserve evidence, and report

If you only started a temporary session

End the session and restart the device. Review the tool's session history and permissions if available, then remove it if you do not need it. Check recent downloads, browser extensions, security alerts, and settings that changed during the session.

If the scammer only viewed a non-sensitive screen, consider what notifications, account names, documents, or codes were visible. Narrow exposure is not a reason for an automatic factory reset.

If persistent remote control software was installed

Keep the device offline until important accounts are protected elsewhere. Uninstall the remote tool through the operating system, but also check startup items, services, scheduled tasks, configuration profiles, browser extensions, new users, and unattended-access settings. Update the operating system and trusted security software, then run a full scan.

Uninstalling one application is not proof of a clean device. Administrator access, disabled security controls, persistence, or sensitive organizational data may justify qualified help and a full rebuild.

If you logged in to an account during the session

Use another device the scammer never controlled. Start with primary email, then financial services, password managers, cloud storage, work accounts, and any service that appeared on screen. Change exposed or reused passwords, revoke other sessions, remove unknown devices and connected apps, inspect forwarding rules, and verify recovery methods.

MFA helps only when the attacker cannot capture or persuade you to approve the factor. Replace compromised recovery codes and examine alerts around the session time. If the scammer could browse files, treat sensitive documents as potentially copied even if no transfer progress appeared.

If you paid or transferred money

Contact the bank, card issuer, payment app, transfer service, gift-card company, or cryptocurrency provider through its official channel immediately. Explain that a scammer had remote access and induced the transaction. Ask about stopping, recalling, disputing, freezing, or replacing the affected method; options differ by payment type and timing.

Save statements, receipts, wallet or transaction identifiers, messages, phone numbers, and provider case numbers. Report through the official fraud or cybercrime channel in your jurisdiction. Be ready for a second scam from someone promising recovery in exchange for another fee or more access.

How should you clean a device after a remote access scam?

Account containment comes first because new credentials should not be typed into a possibly controlled device. Once that is underway, clean the device in a deliberate order:

Preserve essential evidence without opening suspicious files.
Remove known remote-control tools and revoke their unattended-access permissions.
Inspect persistence points, users, extensions, profiles, and security settings.
Install legitimate updates from the operating system or vendor.
Run a full scan with trusted security software.
Back up irreplaceable personal files carefully if a rebuild is being considered.
Reinstall or factory-reset when administrator compromise, persistence, highly sensitive data, or unexplained behavior leaves unacceptable uncertainty.

What evidence should you preserve and where should you report?

Keep existing evidence: the initial message, caller number, remote application name, dates and times, payment instructions, transaction records, and screenshots captured without reconnecting. Write a short timeline while details are fresh.

Report first to organizations that can still limit harm: financial providers, the affected employer, the account provider, or the remote software company. Then use the consumer protection, police, or cybercrime reporting channel applicable to your location. The online scams overview helps identify related impersonation patterns, while the Geek Squad scam guide covers one common brand-specific lure.

Summary

Remote support tools are legitimate; identity, inducement, scope, and financial requests determine whether the session is a scam.
Independently verify the organization before sharing a session code or installing software.
End the connection and move account recovery to a separate trusted device.
Match cleanup to the exposure: temporary session, persistent access, account use, or payment.
A reset is appropriate for some serious cases, not an automatic first step for everyone.

FAQ

Is all remote support software dangerous?

No. Organizations use remote support legitimately when identity, purpose, scope, and consent are clear. The software name alone does not prove either safety or fraud.

Can a legitimate bank ask to control my computer?

Treat such a request as unsafe. End the contact and call the bank through a number on your card, statement, or official app. Do not log in to banking while an unknown person can view or control the device.

What if the scammer only moved the mouse briefly?

End the session and review what was visible or changed. Brief control is less evidence than persistent administrator access, but it may still expose notifications, files, browser sessions, or settings.

Is uninstalling the remote tool enough?

No. It closes one path but does not undo copied data, changed settings, added users, stolen credentials, or financial transactions. Review device, account, and payment exposure separately.

Should I change passwords on the affected computer?

No. Use another trusted device first because remote software or malware could capture the new credentials. Revoke sessions and check recovery settings as well as changing passwords.

Do I always need to factory-reset the device?

No. A reset becomes more reasonable after administrator control, persistent changes, security-tool tampering, sensitive data exposure, or continuing unexplained behavior. A short temporary session with no changes may need a narrower response.

Can a scammer make a fake bank balance appear real?

Yes. Remote control, hidden windows, or altered page content can create a convincing display. Verify the balance independently in the official app on another device or by contacting the institution directly.

What is a recovery scam?

It is a follow-up fraud in which someone claims they can retrieve your money or clean the device for another fee, secret payment, or remote session. Use the original provider and official reporting channels instead.

Disclaimer: This article provides general cybersecurity education and is not legal, financial, forensic, or professional incident-response advice.

Sources

Federal Trade Commission — How To Spot, Avoid, and Report Tech Support Scams — https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams
Federal Bureau of Investigation Internet Crime Complaint Center — Increase in Tech Support Scams Targeting Older Adults and Directing Victims to Send Cash through Shipping Companies — https://www.ic3.gov/PSA/2023/PSA230718
Microsoft Support — Protect yourself from tech support scams — https://support.microsoft.com/en-US/Office/protect-yourself-from-tech-support-scams

Sources checked 28 August 2026.

Related articles:

What Is a Remote Access Scam?