The session may still be active
Closing a window or ending the call may not terminate unattended access or a background connection.
Technology, platforms and channels
I installed remote-access software for a caller — what should I do?
Installing remote-access software does not prove that every account or file was taken. But it creates a credible possibility that the caller viewed information, controlled the device, changed settings or installed something else.
Page P-018Guidance pageReviewed 29 August 2026
Key Guidance
Act promptly without trying to diagnose everything at once. End the session, disconnect the device from the internet, contact the bank from another trusted device if financial access was visible, and begin account and device recovery.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
The response depends on what permissions were granted and what happened during the session. Containment comes before detailed investigation.
Sensitive information may have been visible
Banking, email, password managers, documents, messages and notifications can expose valuable information without an obvious file transfer.
Settings may have changed
New users, browser extensions, startup items, recovery details or administrator permissions may preserve access.
The caller may contact you again
A follow-up person may claim to be a bank, investigator or recovery specialist and use accurate details from the session.
Consequences and movement
What may happen next
Work in order: stop the connection, protect money and critical accounts from another device, then restore confidence in the affected device.
Financial activity
Transactions, new payees, card details or security approvals may need urgent bank intervention.
Account intrusion
Email and other accounts may show unknown sessions, changed recovery information or password-reset activity.
Persistent software
Remote-access tools or extra programs may remain installed and able to reconnect.
Targeted follow-up
The caller can use the original incident as a credible reason for another security or recovery approach.
Practical response
What you should do
Use a different trusted device for banking and critical account recovery where possible. Avoid signing into more services on the affected device until it has been checked.
- End access and disconnectTerminate the session, turn off Wi-Fi or unplug the network cable. If you cannot control the device, switch it off.
- Contact the bank first when relevantFrom another trusted device or phone, explain the remote access and every banking action. Ask the bank to secure access and review or stop transactions.
- Protect email and critical accountsChange passwords from a trusted device, remove unknown sessions and recovery details, and enable stronger two-step verification or passkeys where available.
- Record what happenedWrite down the software, connection time, caller details, screens opened, codes shared, payments made and any changes you noticed.
- Have the device checked and cleanedUse the operating-system or device provider’s official recovery guidance or a trusted professional. Remove unauthorised remote-access software and consider a reset when confidence cannot be restored.
- Monitor and reportReview accounts and credit information where relevant, report the fraud and distrust unexpected recovery or security contact about the incident.
Look more closely
Recovery should address each form of possible exposure
Disconnecting interrupts further remote control, but it does not undo everything already seen or changed. Review device integrity, accounts, payments and shared information separately so each effect receives the right response.
End the session and network connection so live control cannot continue.
Contact financial providers before further transactions or approvals can happen.
Secure email, banking and other high-value accounts from a trusted device.
Remove unauthorised access and restore a trustworthy configuration.
Monitor for reuse of information and false recovery approaches.
Selected history
Historical cases and lasting lessons
Screen-sharing and banking fraud
Remote sessions have been used to observe personal information and access financial accounts while a caller maintains a support or investment story.
Lasting lesson: Bank protection must begin from a separate trusted route as soon as financial exposure is possible.
Post-access malware response
Device recovery may need to address more than the visible remote-access application when other software or settings could have changed.
Lasting lesson: Contain first, then restore the device through trusted guidance rather than improvising inside a possibly controlled system.
Transferable understanding
Patterns over time
One event creates several recoveries
Device, account, payment and identity effects need separate checks and owners.
Visible inactivity is not reassurance
The caller may collect information or change settings without dramatic movement on screen.
Email controls wider recovery
An exposed email account can be used to reset or observe many other services.
The incident becomes a new Mask
A later caller may use accurate details and concern about the original access to appear genuine.
Plain-language answers
Common questions
Should I uninstall the software immediately?
Disconnect first. Record the software and session details, then follow trusted device-recovery guidance. Uninstalling one application may not reverse other changes.
Do I need to reset the device?
That depends on the access and changes made. A trusted technical professional or official recovery guidance can help decide whether cleaning is sufficient or a reset is safer.
Should I change every password?
Prioritise accounts opened, visible or stored on the device—especially email, banking and password managers. Change them from a trusted device and review sessions and recovery details.
Nothing was taken. Can I ignore it?
Absence of immediate loss is not proof that nothing was viewed or changed. Complete the account and device checks and monitor for later activity.
Use separate routes for money, accounts and the device
The bank protects financial access. Each service protects its own account. And trusted technical support restores the device. Preserve evidence and report the event after urgent protective action is underway.
Scamology Insights
Recover the process, not only the device
These learning resources can help you map what the caller could see, control or request. This helps you protect the device, accounts and money that may be affected. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency