The call ends, the "agent" is gone, and you are left with the uncomfortable thought that you let someone into your computer. Maybe you only saw a scary pop-up. Maybe you let a remote session run. Maybe you went further and shared a card number or a password. Whatever the degree, the first hours matter, and the order of your actions matters more than doing a lot. Here is the sequence, starting with the single most important move.
Step one: cut the connection and stop the contact
If the remote session may still be active, disconnect the affected computer from the network — unplug the Ethernet cable or turn off its Wi-Fi. This does not erase anything; it stops a live session from continuing. Then end all contact with the caller. Do not answer the number again, do not click a link they sent, and do not go back to the page where the warning appeared. The goal of a fake tech support scam is to keep you on the line and keep the session open, so the fastest way to defuse it is to remove the connection and hang up.
Note the three levels, because the response scales with them:
- You only saw a warning — lower urgency; still clean up and stay alert.
- You granted remote access — higher urgency; secure accounts and assess the machine.
- You shared money or credentials — highest urgency; the financial and account response comes first.
Step two: act from a device you know is clean
From a clean device, work in this order:
- If money or financial access was involved, contact your bank or payment provider using details you look up yourself — type the number, do not use a number the caller gave you.
- Secure the affected accounts with new passwords, starting with email, then banking and anything sensitive.
- Revoke active sessions where your accounts offer it, and check for unknown devices.
- Review recovery settings and turn on multi-factor authentication if it is not already on.
If this was a work computer, notify your IT department promptly and follow their incident process. Do not try to handle a corporate device's compromise on your own.
Preserve evidence safely — and report it
Keep the scammer's details: the phone number, any email, the name of the app you installed, and the times. Save them from the clean device, not by reopening the suspicious link or running the app again to "check." You do not need to re-expose yourself to document what happened. Then report it. The FTC's guidance on tech support scams and its fraud reporting site are the right places, and reporting helps close these operations.
One honest limitation: removing the remote-access app does not prove the computer is clean. A scammer with a session may have installed other things, changed settings, or captured credentials. Uninstalling the one visible app is a step, not a verification.
What a technician can and cannot do
A professional assessment can look for what was installed, reset affected settings, and confirm the system's state — and, where appropriate, a clean reinstall is the most certain way to reset the machine. But two things are separate from that: recovering your money and your accounts is a financial and account problem, handled with your bank and providers, not by cleaning the computer. And no one, including us, can guarantee that a compromise was fully detected or that a financial loss will be reversed. We are straight about the boundary between "we can clean and assess the machine" and "here is what only your bank or the account provider can decide."
Frequently asked questions
What if I only saw a warning and never clicked?
Your risk is much lower. Clean up the pop-up source, make sure no app was installed, and keep multi-factor authentication on. You probably do not need a full rebuild, but it is worth confirming nothing was installed.
Can I use this PC to change my passwords?
No. Use a clean device. If the machine is compromised, a password typed on it may be captured, which defeats the point of changing it.
Is uninstalling the app enough?
It is a step, not a guarantee. Remote-access tools are one thing; what else may have been installed or changed is another. An assessment is what tells you the actual state.
Should I wipe the machine right away?
Only after you have secured your accounts and preserved the evidence. A reinstall is often the right final step, but do the financial and account response first, and back up anything you need.
Get it assessed after you have contained it
Once the connection is cut and your accounts are secured, the machine still deserves a real look. Contact us to schedule an appointment, or call 716-771-2536 for a drop-off by appointment in Amherst, NY. See our Virus & Malware Removal service. We service Mac and PC, and we will be honest about what a cleanup can and cannot promise.