PC Someone Already Remote-Accessed Your PC: The First Hour Checklist
If a scammer had remote access to your computer, turn off Wi-Fi or unplug the network cable now, then end the session and remove the remote access program. Call your bank, then change passwords from a clean device. Work in that order. Acting in the first hour can still stop transfers and lock the scammer out.
You are not too late, and you do not need to fix everything at once. The steps below are timed for the first hour, starting with cutting the connection. Each step blocks the next risk, so follow them in order even if one takes longer than planned.
Use your phone or another clean device for banking and password changes until your PC is cleared. Do not use the PC the scammer controlled for those calls or logins, even if it looks normal again. Keep it offline while you work through the first steps.
Part of the Is This Microsoft Message Real? Fake Warnings, Real Defender Alerts and What To Do series, the pillar guide for this cluster.
Minutes 0 to 5: disconnect and end the remote session
Disconnect the PC before you do anything else. If it uses a network cable, pull the cable out of the PC or the router and leave it out. If it uses Wi-Fi, turn Wi-Fi off in the taskbar, or turn on airplane mode if you see that option. No internet connection means the scammer cannot keep watching or moving your mouse.
Next, close the remote session itself. Look for a Disconnect, End session, or Close button in the remote access window, or close the window with the X at the top right. If the window will not close, or the pointer keeps moving on its own, hold the power button down until the PC shuts off. Leave it off or offline.
Do not reconnect to test whether it worked, and do not let the scammer back in if they call back. Hang up, even if they sound angry or say the problem will get worse if you stop. Ignore any phone number, note, or instruction left on your screen or in a text file. Those messages came from the scammer.
While the details are fresh, write them down on paper. Note the time the access started and ended, any name or phone number shown, and what the scammer asked you to do. Add what you typed, such as passwords or codes, and any payment you made, including the amount and method. You will need these notes for your bank.
Minutes 5 to 15: uninstall the remote access tool
Minutes 5 to 15: uninstall the remote access tool
Stay offline while you do this. The scammer controlled your PC through a remote access program, and it needs to be removed before the PC goes back online.
Common programs used for this are AnyDesk, TeamViewer, UltraViewer, and ScreenConnect, which may also show as ConnectWise Control. A different name is possible, so look for any program you do not recognize that was installed today, or one the caller told you to download. Its name or icon may also be on your desktop or in the small tray area by the clock.
- Open Settings, then Apps, then Installed apps. Find the remote access program, select the three dots next to its name, and select Uninstall. Follow the prompts to finish, then repeat for any second remote tool you find. Do not open the program to check it.
- Restart the PC, still offline. Open Settings, Apps, and Installed apps again and check the program is gone from the list and from your desktop. Write the name of what you removed on your paper notes.
If you cannot find any remote tool, or the program comes back after the restart, leave the PC offline and shut it down. The same applies if the pointer moves on its own, programs open by themselves, or a new user account appears.
In that case, do not guess and do not reconnect to test it. Take the PC, with your paper notes, to a trusted local repair shop or a person you know in person, and say a scammer had remote access.
Minutes 15 to 30: call your bank and say this
Minutes 15 to 30: call your bank and say this
Call your bank now, on your phone, with your paper notes beside you. Use the number on the back of your bank card or on a paper statement. Do not use a number the scammer gave you, left on your screen, or read out on a call, even if it looks like your bank.
When someone answers, read this out loud: 'A scammer had remote access to my computer. Please check recent activity, block at-risk cards, and tell me what to watch.' Then give the time access began, from your paper notes. Ask them to check transfers out of your accounts, new payees added, and card payments you do not recognize, starting from that time.
Also ask if your phone number, email, address, or payment limits were changed, and stay on the call until they say what they have blocked or frozen. If a card was used while the scammer watched, ask for that card to be stopped and a new one sent. Write down any payment they flag, even if the amount looks small.
If any money was already involved, say so plainly on the same call. Name the amount and method: a transfer, gift cards you bought and shared the codes from, crypto you sent, or a refund you were told was too large and had to return in part. Do not leave any of it out because it feels embarrassing.
Before you hang up, ask for a reference number and the name of the person you spoke to. Write both on your paper notes, with the time of the call and what the bank asked you to watch for, and keep the PC offline during this call. If the scammer calls back, hang up and call the bank again yourself.
Minutes 30 to 50: change passwords from a clean device
Minutes 30 to 50: change passwords from a clean device
Use your phone or another clean device for every change in this section. Keep the affected PC offline and do not sign in to any account on it until the scan in the next section is done.
Start with your main email account. Email comes first because other accounts send password reset links and security codes to that inbox. If the scammer can still read it, they can undo the changes you make next, so change this password before any other.
Then work through these accounts in order. Make each new password different from the others and from any password you have used before:
- Banking and other money accounts, including payment apps.
- Your Microsoft account, which Windows may use when you sign in to the PC.
- Shopping accounts and any other account with a saved card.
- Any other account the scammer opened, asked about, or could have seen on screen.
After each change, turn on two-step verification if the account offers it, in its security settings. This adds a code from your phone, or an approval in an app, as well as the new password at sign-in.
Where an account lists signed-in devices or offers an option to sign out everywhere, use it. Remove any device or place you do not recognize, so a sign-in the scammer kept open is closed.
If your password has already been changed and you cannot sign in, do not keep guessing. Follow the Locked Out and Sign-in pages for that account, and add its name to your paper notes.
Cross off each account on your paper notes as you finish it. If a change cannot be made from your phone, write the account down and leave it for later. Do not use the affected PC to finish it sooner, even if the site looks normal.
Minutes 50 to 60: scan the PC and check for changes
Reconnect the PC now, but only for this check. Turn Wi-Fi back on or plug the network cable back in, then open Windows Security from the Start menu. Go to Virus and threat protection, select Scan options, select Full scan, and select Scan now. Let the scan finish, even if it runs past the hour. Do not sign in to banking or email on this PC yet.
When the scan ends, go back to Virus and threat protection and open Protection history. If Windows Security lists an item, follow the prompt to Quarantine or Remove it. Do not select Allow. Write what it found on your paper notes, exactly as shown, and restart the PC if it tells you to. If the list is empty, write down the time and that nothing was listed.
Next, open Downloads and sort by date, and look again at Installed apps for anything added today. Open your browser's saved passwords page and note any account the scammer opened or could have seen. Add those accounts to your paper list to change from the clean device, if you have not already. Do not open an unfamiliar file to test it.
A clean scan is good news, but it does not prove the PC is untouched. It means Windows Security found no known harmful program. It cannot show whether files were copied or passwords were read while the scammer watched the screen. Keep watching your bank and accounts, and keep the new passwords in place. Keep the paper notes so you can check names and dates later.
After the first hour: report it, watch your accounts, and stop a repeat
Report what happened to the Federal Trade Commission at ReportFraud.ftc.gov. If money was lost, also report it to your local police. Keep your paper notes, the bank reference number, and the name of the program you removed together. You can use the same timeline for both reports, and add any reference you are given.
For the next few weeks, check your bank, card, and email activity often, and call the bank at once about anything you do not recognize. Watch for new accounts, password reset messages, and charges you did not make. If you shared personal details such as your Social Security number, ask the bank whether a credit freeze makes sense and follow its advice.
Remember three rules from now on. Microsoft does not call you or show a phone number for support in a pop-up warning. No stranger should get remote access to your PC. No real bill, fine, or support charge is paid with gift cards or crypto, and a stranger who asks for either is a warning sign.
If a warning or a caller claims to be from Microsoft again, stop before you click, call, or pay anything. Check it with the Real or Fake Warning Checker and read the Call Microsoft Support page. Do not let the same caller, or a new one, back into your PC to fix the first incident.
Conclusion
You have worked through the first hour in the right order, while the details were still fresh and the scammer's access could still be limited. That matters, even if the PC, your accounts, and the next few days do not feel settled yet.
Keep choosing caution over convenience for a while. If a step was left unfinished, or the PC still does something you cannot explain, leave it offline and get in-person help from someone you found yourself. You do not have to sort out the rest tonight.