Remote access scams: when someone else takes control of your screen

No company you have not contacted first will ever phone you about a problem on your computer, and no legitimate organisation ever needs to control your screen to give you a refund, cancel a subscription or secure an account. Those two sentences defeat the entire category.

Australia's National Anti-Scam Centre put remote access losses near $70 million in 2025, and the same pattern appears in FTC, Action Fraud and Canadian Anti-Fraud Centre data. The losses are large because once a criminal controls the device they can open online banking with the victim's own saved credentials.

Cold calls remain common, especially to landlines and older households, with spoofed caller ID showing a local or official-looking number. Pop-up warnings are the other main route: a full-screen page with alarm sounds, a fake scan and a support number, usually reached through a mistyped address or an advert on a low-quality site.

Search results are the third route. Criminals pay for or optimise listings for 'printer support', 'router helpline', 'bank customer care' or 'antivirus refund', so people with a genuine problem call a fraudulent number. Take support numbers only from a product's own app, your account page or the paperwork you already have.

This is the most lucrative variant. The caller says a subscription is being refunded, has you log in to your bank while they watch, then edits what you see on the screen or asks you to type an amount, making it appear that they transferred far too much, say £5,000 instead of £50.

They then plead that the excess must be returned or they will lose their job, and direct you to send the difference by transfer, crypto or gift cards. No money ever arrived. The apparent balance change was a display trick or a transfer between your own accounts, and the money you send is genuinely gone.

Disconnect the device from the internet, by turning off Wi-Fi or unplugging the cable. That instantly ends their control, regardless of what they are doing. Then hang up: there is nothing to negotiate and no explanation you owe them.

If a pop-up will not close, do not call the number and do not click anything inside the page. Close the browser through Task Manager on Windows or Force Quit on a Mac, or restart the device. The warning is a web page, not a scan of your computer.

Uninstall every remote-access tool involved, then restart. Run a full scan with your security software and check for anything that was installed or scheduled during the session. Assume anything visible on screen during the call was recorded, including passwords typed while they watched.

Change passwords from a different, clean device, starting with email and online banking, and enable two-factor authentication. Contact your bank's fraud line to flag the account and review recent transactions and payees, and check whether any new payment recipient or forwarding rule was added. Our virus removal and identity theft recovery guides cover the full sequence.