If you shared your screen with a scammer, end the connection first, then work out whether they only saw the screen, controlled the device, or also obtained passwords, payment details, or files. The same applies whether the caller posed as Microsoft support, said your Microsoft account password had to be reset, or promised a refund. The right response depends on that exposure, but you should secure important accounts from a trusted device before investigating the affected one.

Key Takeaways

Disconnect the session and internet connection before arguing with the caller or clicking around.

Screen viewing, remote control, and disclosed credentials are three different levels of exposure.

Change important passwords and revoke sessions from a device the scammer never controlled.

Contact a bank or payment provider immediately if money or card details were involved.

For a broader security foundation after the urgent work, use the online security guide.

What should you do immediately after a remote access scam?

End the call and remote session. Close the sharing or remote-control app. If you cannot regain control, turn off Wi-Fi or unplug Ethernet; if necessary, power the device down.
Use a different trusted device. Do not start changing passwords on the computer the scammer may still control.
Write down what happened. Preserve the caller number, messages, payment receipts, remote-access app name, approximate times, and accounts that were visible. Do not keep the scammer connected just to collect more evidence.
Call financial providers through a known number. Use the number on your card, statement, or official app, not one supplied by the caller.

Do not reconnect simply because the caller says the interruption will damage the computer or cancel a refund. A legitimate support team can document a case and let you call back through a published channel. If this involved a work device, tell the organization's security or IT contact before deleting tools or logs, because its incident process may require evidence that a personal cleanup would erase.

FTC guidance separates the response by what you gave the scammer: money, personal information, account credentials, or access to a computer.［1］ That same separation prevents both panic and underreaction.

How serious is it if you shared your screen with a scammer?

What happened	What the scammer may have gained	Response priority
They only viewed your screen	Visible messages, names, balances, notifications, codes, or documents	Record what was visible; secure any exposed account or identity data
They remotely controlled the device	Ability to open files, change settings, install software, copy data, or hide activity	Disconnect, secure accounts elsewhere, remove remote tools, update, scan, and consider reset
You typed or read out secrets	Passwords, one-time codes, card details, bank access, recovery answers	Treat those credentials or payment methods as compromised and act immediately

Do not assume that “screen sharing” meant viewing only. Many support tools can grant keyboard and mouse control, file transfer, unattended access, clipboard access, or persistent startup permissions. The FTC notes that fake support agents commonly ask for remote access and that legitimate tech companies won't call, email, or text to say your computer has a problem. Microsoft says it does not make unsolicited calls to provide technical support and warns that such access may be used to install malware or other unwanted software.［2］［3］

How do you secure accounts after a scam?

Start with the accounts that can reset everything else. A practical order is:

Primary email and its recovery methods.
Banking, payment, shopping, and cryptocurrency accounts.
Apple, Google, Microsoft, or other platform accounts tied to the device.
Work, cloud storage, password manager, and social accounts.
Any account whose password or code appeared on screen.

For each affected account, use its official app or type the address yourself. Change a reused or exposed password, sign out other sessions, remove unknown devices, verify recovery email addresses and phone numbers, and turn on MFA. If you no longer control the account, use the provider's official recovery flow rather than links in the scammer's messages.

Record which accounts you changed and which sessions you revoked, but never put new passwords or backup codes in the incident notes. This simple checklist reduces the chance that a lower-priority account is forgotten once the urgent email and banking work is complete.

Changing a password is not the whole job. An attacker may have added a recovery method, connected a third-party app, created an email forwarding rule, or retained an active session. The account-specific response in someone logged into my account covers those checks.

How do you remove remote access software safely?

After important accounts are protected elsewhere, inspect the affected device.

Disconnect it from the network until you are ready to clean it.
Uninstall remote-control or support tools the scammer asked you to install.
Check startup items, browser extensions, installed profiles, and user accounts for additions you do not recognize.
Install operating-system and security updates.
Run a full scan with the device's trusted security software.
If the scammer had administrator control, installed persistent software, or the device keeps behaving strangely, back up irreplaceable personal files carefully and consider a full reset or professional incident response.

Microsoft specifically recommends uninstalling scam-installed applications, scanning, updating, changing passwords, and considering a reset in serious cases. A clean scan is useful evidence, but it cannot prove that every change, copied file, or stolen credential has been reversed.

What should you do about money and identity information?

Speed matters when a payment was made or financial details were exposed. Contact the bank, card issuer, transfer service, or payment app through its official channel. Explain that the transaction or card exposure resulted from a scam, ask what reversal or dispute options exist, and follow instructions about freezing or replacing the affected payment method. FTC recovery steps vary by payment type because card payments, transfers, gift cards, cash, and cryptocurrency have different recovery possibilities.

If the scammer saw an identity document, tax number, medical record, or other high-value personal data, follow the identity-theft process for your country. Save the report reference and monitor relevant financial and government accounts. Do not send more documents to someone who claims they need them to “recover” your money.

The response should match what was exposed. A visible name and balance may justify monitoring, while a full card number, bank login, identity document, or tax identifier may require replacement, a fraud alert, or an official identity-theft report. Ask the relevant institution what it can flag; do not assume a password change protects information that is not a password.

What should you monitor after the immediate response?

For the next several weeks, watch for password-reset messages, new-device alerts, forwarding-rule changes, unfamiliar purchases, new payees, SIM or phone-service changes, and messages sent from your accounts. Warn close contacts if the scammer could impersonate you.

Scammers often return as fake investigators, banks, recovery firms, or government agents. A genuine organization will let you end the conversation and contact it through an independently verified channel. Review common online scams if a follow-up message pressures you to pay again.

Summary

Disconnect first and use a separate trusted device for recovery.
Classify the event as viewing, remote control, or disclosure of credentials and payments.
Secure primary email and financial accounts before lower-value accounts.
Remove remote tools, update, scan, and consider a reset when persistent control is possible.
Keep evidence, contact financial providers quickly, and expect follow-up scams.

FAQ

Is screen sharing alone enough to steal my password?

It can be if the password, one-time code, password manager, email, or recovery page was visible. If the scammer only saw unrelated content and never controlled the device, the risk is narrower, but you should still secure anything sensitive that appeared.

Should I turn off the computer immediately?

If you cannot end the remote session or regain control, disconnecting the network or powering down is reasonable. Once urgent account recovery is complete on another device, preserve useful evidence and begin a controlled cleanup.

Is uninstalling the remote access app enough?

No. It removes one access path but does not reverse copied data, changed settings, added accounts, stolen credentials, or other malware. Review the device and important accounts separately.

Should I change passwords on the computer I shared with a scammer?

Use a different trusted device first. If the affected computer contains malware or an active remote-control tool, new passwords typed there could also be captured.

Does a clean antivirus scan prove the device is safe?

No. A scan can detect known threats, but it cannot prove that no file was copied, no setting changed, and no credential stolen. Administrator access or persistent unexplained behavior may justify a reset or professional help.

What if the scammer only saw my bank balance?

Seeing a balance is not the same as controlling the bank account, but it gives the scammer useful targeting information. If login details, card data, account numbers, or verification codes were also visible, contact the bank and treat those details as exposed.

Should I pay a company that promises to recover the money?

Be cautious. Recovery scammers target recent victims and may demand another upfront payment or more personal data. Contact the original financial provider and relevant official reporting channel yourself.

Do I need to tell my contacts?

Tell them if the scammer saw contact details, accessed email or social accounts, or could impersonate you. Ask them to ignore unusual requests for money, codes, files, or urgent help.

Disclaimer: This article provides general cybersecurity education, not legal, financial, forensic, or professional incident-response advice.

Sources

Federal Trade Commission — What To Do if You Were Scammed — https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
Federal Trade Commission — How To Spot, Avoid, and Report Tech Support Scams — https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams
Microsoft Support — Protect yourself from tech support scams — https://support.microsoft.com/en-us/office/protect-yourself-from-tech-support-scams

Sources checked 4 October 2026.

Related articles:

What to Do If You Shared Your Screen With a Scammer