What to Do After a Remote Access Scam

The Problem

A caller claiming to be from Microsoft, your bank, your ISP, or Amazon convinced you to install AnyDesk, TeamViewer, UltraViewer, or Quick Assist and give them the connection code. For however long they were connected, they had your screen, your keyboard, your files, and any account you were signed into.

That is worse than a normal malware infection in one specific way: a person made decisions. They may have opened your banking site, installed a tool for later access, changed a setting, moved money, or simply photographed the screen while you logged in.

The good news is that most of these operations are financial-fraud crews working to a script, not sophisticated attackers. If you act in the right order, in the first hour, you usually keep the damage to nothing.

Are they still connected right now? Stop reading and unplug the Ethernet cable or turn off Wi-Fi. Then continue. Do not "close the window politely" or keep them talking.

Do These Four Things First, In This Order

Disconnect the PC from the internet. Wi-Fi off, cable out. This ends the session immediately.
Call your bank from the number on your card, not any number the caller gave you. Tell them it was a remote access scam. Ask them to flag the account and check pending transfers.
Change your email password from a different device — your phone on mobile data, or another computer. Email first, because email resets everything else.
Do not turn the PC off yet if money moved. Investigators may want it as-is. If no money moved, it does not matter.

Everything below assumes those four are done.

The Fix: Step-by-Step

Step 1: Remove the Remote Access Software

With the PC still offline:

Settings → Apps → Installed apps → sort by Install date.
Uninstall AnyDesk, TeamViewer, UltraViewer, Supremo, LogMeIn, ConnectWise, ScreenConnect, Splashtop — anything you did not install yourself.
Also uninstall anything else that appeared on the same date. Scammers routinely install a second tool as a backup.

Check C:\Program Files, C:\Program Files (x86), and %AppData% for leftover folders of the same names and delete them.

Step 2: Disable Quick Assist and Remote Desktop

Quick Assist is built into Windows and cannot be uninstalled meaningfully, but Remote Desktop can be switched off:

Settings → System → Remote Desktop → Off.

Then check for a rule they may have added: Windows Security → Firewall & network protection → Allow an app through firewall. Untick anything remote-access related. Hardening guidance if you genuinely use RDP is in secure Remote Desktop (RDP).

Step 3: Find What They Left Running

Remote sessions leave persistence behind more often than people expect — an unattended-access password on the remote tool, a scheduled task, or a service.

Work through remove malicious scheduled tasks and startup persistence in full. Pay particular attention to:

Scheduled tasks created on the date of the call.
Services with no description.
New user accounts — Settings → Accounts → Other users. Delete any account you did not create.

That last one matters: adding a hidden administrator account is a standard move, and it survives everything else you do.

Step 4: Check Whether Windows Security Was Turned Off

Scammers frequently disable Defender "to run their diagnostic".

Windows Security → Virus & threat protection → confirm Real-time protection, Cloud-delivered protection, and Tamper protection are On.
Virus & threat protection settings → Exclusions → remove any folder or file you did not add.
Firewall & network protection → confirm the firewall is On for all three profiles.

If any of these will not switch back on, see Windows Defender not working.

Step 5: Scan Properly

Reconnect the network only now.

Virus & threat protection → Scan options → Full scan.
Then Microsoft Defender Offline scan — this restarts the PC and scans before Windows loads, catching things a live scan cannot.

Full procedure in remove virus and malware.

Step 6: Change Every Password, From a Clean Device

Assume everything typed or stored on that PC is compromised. Using your phone or another computer, in this order:

Email (already done in the first four steps — verify it held).
Banking and payment — bank, PayPal, anything with a card stored.
Microsoft or Google account — it holds device access and password sync.
Everything else, prioritising anything sharing a password with the above.

Do not do this on the affected PC until Step 5 comes back clean. Use a password manager so the new passwords are unique, and turn on two-factor authentication everywhere it is offered.

Step 7: Revoke Sessions, Not Just Passwords

A password change does not always sign out an existing session. If they left themselves signed into your email in a browser on their end, they may still be in.

Go to each major account's security page and use Sign out everywhere / Sign out of all sessions, and review connected apps. Step by step: review and revoke app access and active sessions.

Step 8: Check for Redirected Mail and Changed Recovery Options

A quiet trick: add a forwarding rule or a filter that deletes bank alerts, so you do not see the fraud.

In your email account settings, check:

Forwarding — remove any address you do not recognise.
Rules / filters — especially rules that delete, archive, or forward messages containing "bank", "security", or "verify".
Recovery email and phone number — reset to yours if changed.
App passwords — revoke all and recreate only what you need.

More at recover a hacked email account and set up account recovery options.

Step 9: Deal With the Money Side

If you paid by card, ask the bank for a chargeback and get the card reissued.
If you paid by bank transfer, report it immediately — same-day reporting is what makes recall possible.
If you paid in gift cards or crypto, report it, but recovery is unlikely. Keep the receipts and codes.
If they "refunded too much" and asked you to send the difference back — that is the refund scam. The original credit is fake or reversible. Do not send anything; tell the bank.
Never engage with anyone who later offers to recover your money for a fee. Recovery scams target previous victims from resold lists.

Report it: Action Fraud in the UK, the FTC at reportfraud.ftc.gov in the US, or your national cybercrime unit. Reports matter even when recovery does not happen.

Step 10: Decide Whether to Reinstall

If a stranger had interactive access with administrator rights, a clean install is the only way to be certain. Reinstall if any of these apply:

You cannot account for what they did during the session.
Money moved.
The PC is used for banking or work.
Anything on the checklist above reappears after removal.

Back up documents (not programs), scan the backup, then follow how to clean install Windows 11 or reinstall Windows without losing data.

What Not to Do

Do not call the number back to complain or ask questions. It confirms you are a live target and puts you on a resale list.
Do not let anyone "check the damage" remotely, including a second caller who claims to be from the real Microsoft. Microsoft does not call you.
Do not skip the password changes because the scan came back clean. Screen access alone is enough to have captured credentials.
Do not assume it was harmless because nothing looks different. Persistence and account changes are designed to be invisible.

FAQ

They were only connected for two minutes — is that enough to matter?

Yes. Two minutes is enough to install an unattended-access password on the remote tool, add a user account, or photograph a screen with saved passwords visible. Time on the connection is a poor guide to damage; work through the checklist regardless.

I did not give them any passwords. Am I safe?

Not necessarily. With screen and keyboard control they can open your browser's saved-password page, read your email, and trigger password resets — no typing required from you. Change credentials from a clean device.

How do I know if they installed something for later access?

Check installed apps sorted by date, scheduled tasks and services created that day, new user accounts, and firewall exceptions. Remote tools also have their own "unattended access" setting, which is why uninstalling the tool entirely is better than just disabling it.

Should I factory reset my PC?

It is the safest choice after interactive administrator access, and the only way to be sure if the machine handles banking or work. If the session was brief, clearly scripted, and the checks above are clean, a thorough cleanup is usually proportionate.

Can they still get in after I uninstalled AnyDesk?

Not through that tool once it is fully removed and the network was disconnected during the session. They can if they left a second remote tool, a new user account, an added firewall rule, or a scheduled task — which is exactly why Step 3 is not optional.

The bank says nothing suspicious happened. Do I still need to change passwords?

Yes. Fraud is often delayed by days or weeks so the connection to the call is less obvious, and credentials get sold rather than used immediately. Change passwords and enable 2FA now, and watch statements for at least three months.

Still Not Working?

If unfamiliar activity continues after all ten steps — new sign-in alerts, settings reverting, mail rules reappearing — the account rather than the PC is still compromised. Work through recover a hacked email account and recover a hacked Microsoft account, and consider that a phone number takeover may be involved: prevent a SIM swap attack.