What to Do If Your Parent Let a Scammer Remote Into Their Computer

If a scammer got remote access to your parent's computer, act in this order: disconnect the device from the internet, stop contact with the scammer, change important passwords from a different clean device, contact financial institutions if anything sensitive was exposed, remove remote-access tools, and document what happened.

Do not start with blame. You need facts, access control, and money protection first.

Microsoft says it will not proactively contact people to provide unsolicited technical support, and its guidance warns that real Microsoft warnings do not include a phone number to call. The FBI also warns that tech-support scammers use popups, calls, texts, ads, and websites to push victims into remote access and payment.

Sources: Microsoft support scam guidance, FBI tech support scams

This is the cleanup checklist for the moment after access was granted.

The first 10 minutes

1. End the connection

If the scammer is still connected, disconnect the computer from the internet:

• Unplug the Ethernet cable, or
• Turn off Wi-Fi, or
• Power off the home router if you cannot reach the computer safely

Do not keep debating with the caller. Do not let them "finish fixing it." Do not type anything else while they can see the screen.

2. Stop contact

Hang up. Stop replying to texts or chats. Do not call back.

If they call again, do not explain. The explanation gives them another chance to pressure the family.

3. Write down what happened

Before memory blurs, write:

• Phone number or website involved
• Name the scammer used
• Remote-access tool installed, if known
• Whether money was paid
• Whether bank, email, or password screens were opened
• Whether identity documents were visible
• Approximate start and end time

This helps the bank, law enforcement, and whoever cleans the computer.

The first hour: protect the accounts

Use a different device you trust. Do not change passwords from the computer the scammer controlled.

Change the email password first

Email is the recovery key for everything else.

Change the password for the primary email account. Turn on MFA if it is not already on. Check recovery phone numbers, backup email addresses, forwarding rules, and suspicious app access.

If the scammer watched the parent log into email, assume the password is exposed.

Then change financial and identity accounts

Prioritize:

• Bank and credit card accounts
• Brokerage and retirement accounts
• Social Security and IRS accounts if used
• Apple ID or Google account
• Microsoft account
• Password manager
• Health portals
• Primary shopping accounts

Change reused passwords anywhere they were used. Reuse is how one exposed password becomes many accounts.

Turn on MFA for key accounts

CISA's home security guidance emphasizes strong passwords, MFA, recognizing phishing, and updates. In this situation, MFA is especially important because the scammer may already know or have seen passwords.

Source: CISA: Secure Yourself and Your Family

Contact the bank if anything financial was visible

Call the bank or card issuer using a number from the card, statement, or official app. Do not use any number the scammer provided.

Tell them:

"A tech-support scammer had remote access to the computer. Banking or payment information may have been visible. I need help protecting the account."

Ask about:

• Card replacement
• Account monitoring
• Transaction disputes
• Online banking password reset
• New account numbers if needed
• Alerts on wires, ACH, Zelle, or other transfers
• Brokerage account protections if investments were visible

If money moved, time matters. The FTC's scam guidance advises contacting the company used to send money and asking whether it can be reversed.

Source: FTC: What To Do If You Were Scammed

Remove the remote-access tool

Common remote tools used in scams can include legitimate products. The tool is not always malicious by itself. The problem is that the scammer used it.

Look for recently installed software such as:

• AnyDesk
• TeamViewer
• UltraViewer
• LogMeIn
• GoToAssist
• ScreenConnect
• Remote support browser extensions

Uninstall anything that was installed for the session. If you are not sure what belongs, get help before deleting randomly.

Then run trusted security scans. Use security software already known to the family or a reputable built-in tool. Do not download a "cleaner" from a link someone sends after the scam.

Decide whether to rebuild the computer

Not every remote-access scam requires a full wipe, but some do.

Consider a rebuild if:

• The scammer had administrator access
• Files were downloaded or commands were run
• Security tools were disabled
• Banking or identity documents were accessed
• The computer is used for business, payroll, legal, tax, or medical data
• The family cannot tell what changed

For a personal machine, a careful cleanup may be enough. For a business machine or a device tied to regulated data, preserve evidence and get professional help before wiping.

Watch for the second scam

After one scam, the family may get more calls.

The follow-up pitch may sound like:

• "We can refund your money."
• "We are the fraud department."
• "We can recover the stolen funds."
• "Your bank account is unsafe; move the money."
• "The first technician was fake, but I am real."

The FBI warns that scammers may share victim information and attempt additional fraud. Treat every follow-up contact as suspicious until verified through a known path.

Source: FBI tech support scams

Report it

Reporting does two things: it creates a record and helps agencies track patterns.

Use:

• ReportFraud.ftc.gov
• FBI IC3
• IdentityTheft.gov if identity information was exposed or misused

If money moved, also call the financial institution immediately.

How to talk to your parent

This part matters more than families think.

Do not lead with "How could you fall for that?" Lead with:

"I'm glad you told me. Let's protect the accounts first."

Shame delays reporting. Delayed reporting increases loss.

Ask neutral questions:

• What did they say was wrong?
• What did they ask you to install?
• Did they ask you to log into anything?
• Did they ask for payment?
• Did they mention the bank?
• Did they say not to tell anyone?

You are building a timeline, not prosecuting a family member.

Prevent the next one

After cleanup, put three controls in place:

1. A family fraud fire drill: no urgent request is handled from the first call.
2. A known support path: one real number or person to call for device trouble.
3. Email and account hardening: unique passwords, MFA, and recovery methods checked.

The family fraud fire drill gives the pre-incident plan. The live article on tech-support scams explains how the fake Microsoft popup works.

Where Obsidian Ridge fits

Obsidian Ridge helps families clean up after scams and reduce the chance of a repeat: secure the email, harden key accounts, check devices, simplify passwords, and create a clear escalation path.

If the household needs direct help, start with individuals and families. If the affected device belongs to a business, use the briefing form because the evidence and liability questions are different.

FAQ

What should I do first if a scammer got remote access?

Disconnect the computer from the internet, stop talking to the scammer, and change important passwords from a different clean device, starting with email and banking.

Should I wipe the computer?

Sometimes. If the scammer had admin access, changed settings, downloaded files, or the device handles sensitive business or regulated data, a rebuild may be safer. For serious incidents, preserve evidence before wiping.

Which passwords should be changed first?

Start with email, then banking, Apple or Google, Microsoft, password manager, shopping, health portals, and any account using the same password.

Should I call the bank?

Yes if banking, card, investment, payment-app, or identity information may have been visible or shared. Call using a known number, not one from the scammer.

Can antivirus fix this?

Antivirus can help find some malware, but the main risk is access and account exposure. Password changes, MFA, bank contact, remote-tool removal, and monitoring matter just as much.

Sources and references

• Microsoft support scam guidance
• FBI tech support scams
• FTC: What To Do If You Were Scammed
• IdentityTheft.gov
• CISA: Secure Yourself and Your Family