5 min lesson

Remote access and tech support scams: when someone asks to take control

This one moves fast, and it is usually already in progress by the time anyone realises. Someone contacts you claiming to be from a company you trust, tells you there is a problem with your computer, your internet or your bank account, and asks you to install a small piece of software so they can help. That software hands them control of your device.

Why it works

It works because the caller is helpful, patient and technically fluent, and because the problem they describe sounds plausible. They are not asking you for money at the start. They are asking you to accept help. By the time money is mentioned, you have already spent twenty minutes trusting them.

How the call usually goes

The script varies but the shape is remarkably consistent.

The opening. A call, a pop up with a warning and a number to ring, an email about a subscription you did not order, or a text about a delivery problem. The pop up version is common because it makes you place the call, which feels safer.
The problem. Your device is infected, your router has been compromised, your broadband has been throttled, or a refund is owed on a service you are cancelling.
The tool. You are guided to install remote access software. AnyDesk, TeamViewer, UltraViewer and Quick Assist are the names used most often. These are real, legitimate products, which is exactly why they are chosen.
The proof. They show you something alarming on your own screen, often the Windows Event Viewer or a command prompt, and describe ordinary entries as evidence of infection.
The money. Either a fee for fixing it, or the refund version, where they appear to overpay you and ask you to send the difference back. The overpayment is faked by editing what your browser displays.
The escalation. In the bank version, they tell you your account is compromised and that you must move your money to a safe account. There is no such thing as a safe account.

Red flags

The strongest signal is not what they say. It is what they ask you to do.

They contacted you. Microsoft, BT, your bank and your internet provider do not ring you out of the blue about a virus.
They want you to install something so they can see your screen or control your device.
They ask you to log into your online banking while they are connected.
They tell you not to discuss it with bank staff, family or the police, or to say the payment is for something else.
They ask you to buy gift cards, or to move money to a new account for safekeeping.
The number they called from looks correct. Caller ID can be faked, so a familiar number proves nothing.

The one habit that protects you

Nobody legitimate needs control of your device to solve a problem you did not report. If you take one thing from this lesson, take that sentence.

Hang up. You do not owe a cold caller politeness, and hanging up is not rude when the alternative is losing your savings.
Call back on a number you found yourself. Use the number on your bank card, your paper bill or the official website you typed in. Wait five minutes first, or use a different phone, because a scammer can hold the line open.
Never install remote access software at the request of someone who contacted you.
Never log into banking, email or anything else while someone is viewing your screen.
Close alarming pop ups with Task Manager or by closing the browser, not by clicking anything inside the pop up window.

If you have already given access

Assume they saw everything on the screen and could have installed more. Work through this in order.

Disconnect the device from the internet. Turn off wifi or unplug the cable. This ends their session immediately.
Uninstall the remote access software they had you install.
Ring your bank on 159, or the number on your card, from a different phone if you can. Tell them a scammer had remote access.
Change your passwords from a different device you trust, starting with email, then banking, then everything that shares a password.
Turn on two step verification on your email account first, because email is the key to everything else.
Run a full scan with your security software, and if you are not confident the device is clean, have it checked properly.
Report it to Report Fraud on 0300 123 2040, or Police Scotland on 101 in Scotland.

The one thing to remember

Nobody who genuinely works for your bank, Microsoft or your internet provider will ever ask to take control of your device or move your money to a safe account.

Check what you have learned

Four quick questions. There is no score to beat and nothing is recorded, it is just a way of making the lesson stick.

1.A caller says they are from your internet provider and asks you to install AnyDesk so they can fix your connection. What should you do?

2.Your bank's fraud team calls and says your account is compromised, so you must move your money to a safe account they have set up. What is this?

3.You have just realised the person with remote access to your laptop is a scammer. What is the very first thing to do?

4.A full screen pop up warns of a virus and gives a support number. What is the safest action?