I let someone control my computer

Anything you could open on that computer, they could open too, and they may have left a way back in. Use another device until it’s clean.

If it’s happening now

They’re still connected, or you’re not sure. Press and hold the power button until the screen goes dark. It can take up to 10 seconds. On many laptops it’s the key at the top right. Don’t close their program first or wait for them to finish. If it won’t turn off, unplug your internet box (the modem or Wi-Fi router). If your home phone plugs into that box, use your cell phone.

They’re on the phone. Hang up. You don’t owe them a reason. If they call back, don’t answer.

It was your phone. End the call, turn the phone off, and call your bank from another phone. No other phone? Use a landline or a family member’s phone, or go to a branch.

They’re gone. Leave the computer off, and use another device for everything below.

What to say

• Someone I don't know had control of my computer while I was signed in to online banking. Can you stop anything pending, lock my online banking, and give me a case number?

• Can you check for anyone newly added to send money to, a new linked account at another bank, transfers between my own accounts, wires, a new device signed in, and any change to the phone number or email on file?

• I didn't make that transfer. The person who had control of my computer did. I want it handled as an unauthorized transfer under Regulation E.

• Someone I don't know had remote control of this computer. Can you remove whatever they installed? If you can't be sure it's clean, I'd rather back up my files and reset it.

If something already left your hands

Go in this order. Some payments can still be stopped, so the bank comes first.

They could see your bank, cards, or payment apps

Call the number on the back of your card, from your phone. Do the same for every money account they could have reached, including retirement and investment accounts. Tell them someone had control of your computer, and when. Use the scripts above, get a case number, and if your screen went black while they were connected, say so.

Money left

They moved it themselves. Tell the bank you didn’t make that transfer. The CFPB says a transfer made by someone who tricked you into sharing access to your account can count as unauthorized under federal rules (Regulation E). Wires aren’t covered; ask for a recall on the same call. Call today. What you can owe is lowest if you report within two business days of finding out.

You sent it yourself. Money you sent by wire, Zelle, a payment app, gift card, crypto, or cash may be treated as authorized, and often isn’t paid back. For a wire, Zelle, or app payment, ask for a recall anyway, and for the decision in writing. If they say no, file a complaint at consumerfinance.gov/complaint. For a wire or crypto, also file at ic3.gov at the same time as you call the bank. Steps by payment type: I paid or sent money.

Passwords

From a device they never touched, change these in order: your email, your password manager if you have one, banking and payment apps the bank didn’t reset, your Apple, Google, or Microsoft account, then every password saved in that computer’s browser. Treat those as seen.

Turn on two-step sign-in as you go. A passkey or an authenticator app is the goal; codes by text message are better than nothing. More: Someone got into my account.

They could see your Social Security number, tax returns, or ID. Freeze your credit. It’s free. Steps: I gave out a code, password, or card number.

Then the rest

Write down the program’s name, the phone number, any website they sent you to, and what they asked for. Don’t turn the computer on to get screenshots. More on what to save. Then report it at ReportFraud.ftc.gov and to the FBI at ic3.gov.

If you’re 60 or older, or helping someone who is, the National Elder Fraud Hotline assigns a case manager to help with reports: 833-372-8311. Scammers have posed as hotline staff, so call them yourself. AARP’s free helpline is open to anyone: 877-908-3360.

Anyone who later offers to recover your money for a fee, even someone claiming to be the FBI, IC3, the FTC, or a lawyer, is running a second scam. Someone offers to get my money back.

Cleaning the computer

Don’t bank or check email on it until you’ve done this. Unplug your internet box first so nothing can reconnect while you work, and plug it back in for the updates. If your home phone runs through it, use your cell phone.

Look for these, plus anything installed the day they were on: AnyDesk, TeamViewer, ScreenConnect (also called ConnectWise Control), UltraViewer, LogMeIn, Splashtop, RustDesk, Chrome Remote Desktop. Remove any you didn’t set up yourself. Once installed, some of these let them back in without you clicking anything.

Windows

1. Start > Settings > Apps > Installed apps. Next to each program they had you install, select More (the three dots) > Uninstall. On Windows 10 it’s Settings > Apps > Apps & features: select the program, then Uninstall. Not listed? Delete it from your Downloads folder; AnyDesk can run without being installed.
2. Quick Assist comes with Windows. It can’t reconnect without a new code from you, so you can leave it.
3. Plug the internet back in. Start > Settings > Windows Update, and install what’s waiting. On Windows 10 it’s Settings > Update & Security > Windows Update.
4. Save your work. Open Windows Security, then Virus & threat protection > Scan options > Microsoft Defender Antivirus (offline scan) > Scan now. The computer restarts to scan, then restarts again. The scan may not flag AnyDesk or TeamViewer. They’re real programs, so remove them yourself (step 1).

Mac

1. Finder > Applications. If what they installed has its own Uninstall app, use it. Otherwise drag it to the Trash and empty the Trash.
2. Apple menu > System Settings > Privacy & Security. Under Screen & System Audio Recording, and again under Accessibility, turn off anything you don’t use. Then go to General > Login Items & Extensions and turn off anything from the program they installed.
3. Plug the internet back in. Apple menu > System Settings > General > Software Update.

Macs have no scan button. The built-in malware check runs on its own. It won’t remove AnyDesk or TeamViewer, because those are real programs. Step 1 does that.

When to hand it to a repair shop

Hand it over if you can’t find or remove what they installed, if they had you type your computer’s password, or if you bank or do taxes on it and want to be sure. Pick the shop yourself, not one the caller or a pop-up named.

The surest fix is a reset. Windows: Settings > System > Recovery > Reset PC. On Windows 10 it’s Settings > Update & Security > Recovery > Reset this PC > Get started. “Keep my files” removes apps but keeps your documents and photos. Macs with Apple silicon or a T2 chip (most from 2018 on): System Settings > General > Transfer or Reset > Erase All Content and Settings, which erases everything, so back up first. No such option, or not comfortable doing it? A shop can do either.

What it looks like

You called the number in an email about a $299.99 renewal you never ordered. The man who answered is connected to your computer and had you sign in to your bank to get the refund.

(614) 555-0147

Outgoing call · 2:31 PM

1. Caller Okay, I have the refund form open. I'll type in the amount. Please don't touch the mouse.
2. Your screen goes black for about two minutes.
3. Caller Oh no. I'm so sorry. I typed 29,999 instead of 299.99. Can you look at your account?
4. Your bank's page is back. Checking shows $32,145.22. This morning it was $2,146.22.
5. Caller That's company money. If my manager sees this, I lose my job. A reversal takes weeks and gets your account frozen, so you need to send back the $29,699 difference today. I'll stay on the line with you.

The money is right there on your bank's own website. What do you do?

• Send back the difference. You can see it in your account
• Ask him to take it back himself, and stay on while he does
• Hang up, turn the computer off, and call the number on your card
• Open your bank's app on your phone to compare, but stay on the call

Show the answers

• Wrong move Send back the difference. You can see it in your account While your screen was dark, he moved your own savings into checking, or edited what the page shows. Whatever you send back comes out of your accounts.
• Wrong move Ask him to take it back himself, and stay on while he does Whatever he takes back, he takes from inside your bank account. While you stay on the line, he's still in your computer.
• Best move Hang up, turn the computer off, and call the number on your card Turning it off ends his connection. The fraud team at the number on your card sees your real balances. Tell them someone was in your online banking while your screen was dark, and ask them to look for transfers between your accounts and anything sent out.
• Okay Open your bank's app on your phone to compare, but stay on the call Your phone shows the real numbers, because he isn't on your phone. But he's still on your computer and in your bank account while you look. Turn the computer off first.

When someone on your computer says they refunded too much, that's the scam. Turn the computer off and call the number on your card.

Yesterday a "technician" had control of your computer for 40 minutes. You haven't told anyone yet.

(202) 555-0178

Incoming call · 10:05 AM

1. Caller Good morning, this is Ryan Mitchell with Fernmont Bank's fraud department. Am I speaking with the account holder?
2. You Yes.
3. Caller We flagged a remote connection to your computer yesterday afternoon, through a program called AnyDesk. It came from an overseas address.
4. Caller Whoever that was got into your online banking. Your checking and savings are both exposed.
5. Caller Don't sign in to online banking until our security team calls you back.
6. Caller For your protection, don't discuss this with anyone at your branch. We think someone there may be involved.

He knows about yesterday, and you haven't told anyone. What do you do?

• Do what he says. Only your bank could know about yesterday
• Hang up and call the number on the back of your card
• Ask for his direct number and call him back on it

Show the answers

• Wrong move Do what he says. Only your bank could know about yesterday Your bank might have spotted it. So did whoever was on your computer. You can't tell which from here, and you don't need to. The FBI calls this the phantom hacker scam: a fake technician, then a fake bank, then a fake government agent.
• Best move Hang up and call the number on the back of your card You needed to call your bank about yesterday anyway. Your real bank can lock your online banking and watch your accounts without you moving a dollar.
• Wrong move Ask for his direct number and call him back on it A number he gives you reaches him. The one on your card reaches your bank.

A caller who knows about yesterday could be your bank or the people who were on your computer. Call the number on your card and you'll reach the real one.

What they’ll ask for

Each of these is the scam. Hang up, hold the power button, and call the number on your card.

“Sign in to your bank so I can send your refund.” That’s how they get into your account.

“I sent too much. Send back the difference.” The extra is your own savings moved over, or an edited page. If real money did arrive, don’t send it anywhere. Tell your bank.

“Send it back with gift cards, a wire, or the Bitcoin ATM at the gas station.” “A courier will pick up the cash.” No real bank, agency, or company sends a courier for cash or tells you to use a Bitcoin ATM or buy gift cards.

“If the bank asks, say it’s for a sick relative.” A caller who tells you what to say to your bank is the scam. Tell the teller the truth.

“Don’t touch the mouse. Your screen will go black for a minute.” That’s when they work in your accounts.

“Type your computer’s password.” “Read me the code we just sent.” The password lets them approve installs they can’t make on their own. The code lets them sign in as you. Never read or forward a code to anyone who contacts you.

“I’m transferring you to your bank’s fraud team” (or the Federal Reserve, or the FBI). Same scam, next caller. No bank protects your money by asking you to move it.