How Scammers Abuse Remote-Access Tools Like AnyDesk and TeamViewer

Short answer: AnyDesk, TeamViewer and ScreenConnect are real, legitimate programs that let one person see and control another person's screen from anywhere, and IT helpers use them every day. Scammers misuse the same tools by talking someone into installing one, and from that point they can do anything the person sitting at the computer could do. Nobody who phones you out of the blue has a good reason to ask you to install one. If that has already happened, disconnect the computer from the internet first and change passwords from a different device.

AnyDesk, TeamViewer, and ScreenConnect are real, useful programs. IT helpers use them every day to fix computers without driving to your home. The programs let one person see and control another person's screen from anywhere. Scammers have learned to misuse the same tools. They talk people into running them, then use the connection to reach bank accounts.

This article explains how the scam works, what to watch for, and what to do.

What "remote access" means

When someone accesses your computer remotely, they can see your screen. They can move your mouse, open files, and type — as if they were sitting right in front of it.

A real IT helper uses this to diagnose problems and apply fixes without leaving their desk. That is a legitimate service. Many families use it to get help from a son, daughter, or IT provider they trust.

The danger is that the same capability works for anyone you let in. Once you run one of these programs and share a code with a stranger, that stranger has full control of your computer.

How the scam works

The Cybersecurity and Infrastructure Security Agency (CISA) describes this pattern in Advisory AA23-025A.

Step 1: You get a message or a call. In the campaign CISA describes, it started with an email that looked like it came from a help desk. Some emails had a link. Others asked people to call a phone number. Other versions of this scam start with a pop-up or a phone call. Each one says there is a problem and offers to fix it.

Step 2: "Install this so I can help." The person directing you — or a link in the message — tells you to download and run a remote-access program. CISA notes that some versions of these programs run without a full installation and without requiring administrator permission. That means your computer may not ask you for a password or show a security warning before the program starts.

Step 3: Log into your bank for a "refund." CISA describes this as a refund scam. While still connected, the scammer asks you to log into your bank account. Then they use the remote tool to change what the bank page shows, so it looks as if you were refunded too much. They ask you to send the "extra" back. The money you send is your own.

Step 4: No alarm goes off. CISA states: "The use of RMM software generally does not trigger antivirus or antimalware defenses." Your security software may show nothing at all. CISA also notes that criminals can misuse any legitimate remote-access program. The programs themselves are not the problem.

CISA identified a widespread campaign in October 2022 in which help-desk-themed emails led people to download ScreenConnect and AnyDesk for exactly this purpose.

What the numbers show

The FBI's Internet Crime Complaint Center (IC3) reported that in 2025, people aged 60 and over filed more than 21,000 complaints related to tech and customer support scams, with losses of more than $1 billion. Those figures come from the 2025 IC3 Annual Report. You can report fraud at ic3.gov.

Signs someone may be connected to your computer right now

1. Your mouse is moving on its own — without you touching it.
2. Programs are opening or closing by themselves.
3. You see a small icon or window you do not recognize, with a name like AnyDesk, TeamViewer, or ScreenConnect.
4. Someone on the phone is telling you exactly which buttons to click, in real time.
5. You were asked to type an access code into a program so someone could "connect and take a look."

What to do right now

If you think this is happening or has already happened, act now.

1. Disconnect from the internet. Unplug the network cable or turn Wi-Fi off. This cuts the connection.
2. Close the remote-access program. If you cannot find it, shut the computer down entirely.
3. Do not log back into any account on that computer until someone has checked it.
4. Call your bank from the phone number on the back of your card. Tell them what happened. Ask them to check for unauthorized transactions and freeze the account if needed.
5. Follow the full recovery steps in What to do if a parent let a scammer remote into their computer.
6. Report the incident to the FBI at ic3.gov.

How to prevent this

One rule to agree on. Never let anyone you did not call yourself connect to your computer. If someone contacts you first, by phone, email or pop-up, and offers help, that is the warning sign. A real company will not mind if you hang up and call back on a number you already have.

Check your computer for remote-access programs you do not recognize.

On a Windows computer, open Settings and go to Apps (on some versions it appears as "Apps & features"). Scroll through the list. Look for anything with a name like AnyDesk, TeamViewer, ScreenConnect, or any name containing the words "remote," "assist," or "support" that you do not remember installing. If you see something unfamiliar, do not open it. Ask a trusted person to look at it with you before removing anything.

On a Mac, open Finder and go to the Applications folder. Scroll through and look for the same kinds of names. Again, if you find something you do not recognize, ask a trusted person before taking action.

A program a trusted person set up on purpose is fine. If a family member or an IT provider you hired installed a remote-access program so they can help when something goes wrong, that program is not a danger. You should know it is there, know who uses it, and have agreed to it. The risk is a program you did not ask for, installed because a stranger told you to.

Talk to family members now, before a scam happens. A short conversation is the best prevention: agree together that no one will ever let an unexpected caller or message take control of their computer, and that anyone who gets a suspicious pop-up or call will contact a family member first before clicking anything. The printable fridge card puts that rule, and a family member's number, next to the computer.

How Obsidian Ridge helps

Ridge Watch is managed monitoring for home computers. Analysts in a 24/7 security operations centre review every alert and take action — they remediate it, note it, or isolate the computer from the network to contain a threat. Taking a computer offline is one of those three outcomes, not what happens every time. A contained computer stays offline until we review it, within one business day.

On Windows Pro computers, Ridge Watch can also block remote-control tools nobody approved from running in the first place. Windows Home is not supported.

Ridge Watch works on Windows and Mac computers.

What Ridge Watch cannot stop. It cannot stop a phone call, or someone being talked into paying. That includes handing over gift cards, wiring money, using cryptocurrency, or logging into a bank to process a "refund." On a computer without blocking, a remote-access tool someone lets in on purpose may not look like an attack — CISA confirms these tools generally do not trigger antivirus defenses, so it may not raise an alert. Phones and tablets are not covered.

See plans and pricing at Ridge Watch.