Gave a scammer remote access? What to do now

Someone called, or a pop-up told you to call, and you let them onto your computer with AnyDesk, TeamViewer, UltraViewer or a similar tool. That happens to careful people every day. Take a breath: the steps below are simple, and the sooner you do them, the less harm the scammer can do.

1. The first 10 minutes

1. End the session and go offline. Close the remote-control window, then unplug the network cable or switch off Wi-Fi (the Wi-Fi symbol at the bottom right › Wi-Fi off). Without internet, the scammer cannot get back in.
2. Call your bank. Use the number on the back of your card or on your bank statement, never a number the caller gave you. Say that someone had remote control of your computer. The bank can block cards, stop payments and watch your account. Do this even if you think you did not pay anything.
3. Do not answer the scammer again. They often call back, angry or friendly, sometimes pretending to be your bank or the police. Hang up.
4. Did you hand over codes? If you read out a code from a text message, an app or a card reader, tell your bank. Those codes approve payments.

2. Change your passwords from another device

Use your phone or another computer, not the one the scammer was on. The scammer may have seen your screen, your saved passwords or your files.

1. Your e-mail account first. Whoever controls your e-mail can reset most other passwords. Also check that the recovery phone number and recovery e-mail are still yours, and that no forwarding to a stranger was added.
2. Online banking and payment accounts (PayPal and similar).
3. Shops, social media and anything with a saved card.
4. Switch on two-step sign-in (a code on your phone as well as the password) wherever it is offered.

If you saved passwords in your browser, assume the scammer could have seen them, and change those too.

3. Remove the remote-control program

A remote-control program lets another person see your screen and use your mouse and keyboard. Many are honest tools used by IT helpers; scammers simply abuse them.

1. Open Settings › Apps › Installed apps (Windows 10: Apps & features).
2. Look for AnyDesk, TeamViewer, UltraViewer, RustDesk, Supremo, ScreenConnect, LogMeIn, Splashtop or anything with "remote", "support" or "desk" in its name that you did not install yourself. Click the three dots or the entry › Uninstall.
3. Some of these tools run without being installed. Look in your Downloads folder and on the desktop for files like AnyDesk.exe or TeamViewerQS.exe and delete them.
4. Quick Assist is part of Windows. It only works when you open it and type in a code, so simply never do that for a stranger.

4. Check what the scammer may have left behind

Scammers sometimes add a second way back in. These checks take about 15 minutes:

• New programs: in Installed apps, sort by date. Anything installed on the day of the call that you don't know, remove it.
• New user accounts: Settings › Accounts › Other users (Windows 10: Family & other users). An account you never created is a clear warning sign. Remove it.
• Programs that start with Windows: press Ctrl + Shift + Esc to open Task Manager › Startup apps (Windows 10: Startup). Right-click anything unknown › Disable.
• Remote Desktop: Settings › System › Remote Desktop. If it is on and you don't use it, switch it off. (On Windows Home, Remote Desktop can't be switched on, so you can skip this.)
• Browser: remove extensions (small add-ons) you don't know, and check that your start page and search engine are still the ones you chose.

5. Scan the computer

Open Windows Security (Start › type Windows Security) › Virus & threat protection › Scan options:

• Full scan: checks every file. It takes a while; you can reconnect to the internet first so it has the latest updates.
• Microsoft Defender Offline scan: restarts the computer and scans before Windows starts, so hidden malware can be found. Save your work first.

Still unsure? If the scammer had a long session, installed things you can't explain, or you see strange behaviour afterwards, the safest way is to back up your personal files (photos, documents) and reset Windows: Settings › System › Recovery › Reset this PC. A trusted local IT professional can help you with this. You can also report the scam to the police or your country's fraud reporting service.

6. How the scam works, and how to spot it next time

The story changes, the pattern stays the same:

• The hook: a pop-up says your computer is infected and shows a phone number, or someone calls "from Microsoft", your bank, your internet provider or an online shop. Sometimes it's a "refund" you supposedly have to collect.
• The access: they ask you to install AnyDesk, TeamViewer, UltraViewer or similar and read out the code. Now they see and control your screen.
• The trick: they show you scary but meaningless lists (for example from Event Viewer, which always has warnings), or make it look as if they sent you too much money and you must pay it back.
• The goal: your online banking, gift cards, a "fee" for the repair, or a second program so they can come back.

Simple rules that protect you:

• Microsoft, your bank and real shops never call you unasked to fix your computer, and never ask for gift cards.
• A pop-up with a phone number is always fake. Close the browser (Ctrl + Shift + Esc › end the browser task if it won't close).
• Never let a stranger who contacted you onto your computer. If in doubt, hang up and call the company on a number you looked up yourself.
• Never open online banking while someone else is connected to your computer.

7. Seeing what your PC does, at any time, with Coinetic

Doing this by hand means checking apps, accounts and startup programs yourself, and remembering to do it again. It only shows the moment you look. You don't see a program quietly "phoning home" at night, and the Windows Firewall lets every program connect out by default, so a new remote-control tool simply works.

Coinetic works through the Windows Firewall that is already on your computer. It is not an antivirus and does not remove viruses; keep Windows Security for that. What it adds is the network side: who your computer talks to, and the power to stop it. No tool can promise 100% security.

• No program goes online without you knowing: with outbound control switched on, every new program asks once before it may connect to the internet, with who signed it, where it wants to go and a plain recommendation. A remote-control tool a scammer leaves behind cannot quietly connect; you see it and can block it.
• Remote-control behaviour stopped by itself (every plan): Coinetic learns what is normal for your computer for 7 days. After that, a program that contacts one unknown address again and again at almost exact intervals (typical for remote-control malware), or suddenly contacts many addresses, can be cut off from the internet automatically. You get the message Coinetic stopped <program> from reaching the internet: <reason> with Release or Keep blocked.
• Every connection, with a name: the Connections page shows what is connected right now, with the program, who owns the address and the country. Right-click to see who signed the program, block it or stop it.
• Firewall changes are reported: if a program, installer, malware or a person switches the firewall off or opens a door from the internet, Coinetic tells you which program did it, and can switch the firewall back on by itself.
• Open doors closed: the one-click Security check finds ports (doors into your computer) that are open to the whole internet, such as Remote Desktop. Coinetic closes it, or makes it invisible forever or until you unlock it from your phone. You can try the free open-port check for your own address.
• At any time, not just once: Coinetic runs in the background, also when its window is closed. The Overview shows green when you are protected and amber when something needs you, the Programs page lists every program that went online and what was decided, and a notification appears when something needs you.
• Your AI security analyst (Pro + AI): right-click any line, program or connection and choose Ask AI, e.g. “Is any remote-control program still connecting out from this PC?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.

More guides: all Coinetic guides.

Frequently asked

I gave a scammer remote access to my computer. Can they still get in?

Only if the remote-control program is still there and running, or they installed a second one. Go offline, uninstall the tool, check installed apps, user accounts and startup apps, and run a full scan. If you are unsure, reset Windows after backing up your files.

Is AnyDesk, TeamViewer or UltraViewer a virus?

No. They are honest remote-support tools. The danger is who is on the other end. If you did not install it for someone you know and trust, remove it.

The scammer saw my bank account but I didn't pay. Am I safe?

Call your bank anyway. Scammers may have noted your details or seen codes, and banks can watch for unusual payments. Change your online banking password from another device.

Should I reset my whole computer?

If the session was short and the checks above find nothing, a full scan is usually enough. If the scammer was connected for a long time, installed other programs or you still see strange things, a reset is the safest way to be sure.