What to Do If Your Parent Let a Scammer Remote Into Their Computer

If a scammer just had remote access to your parent's computer, do this first: cut the internet connection, stop all contact with the caller, and change the most important passwords from a different device. The six steps below cover the first hour.

The first hour

Work through these in order. Do not skip ahead. Steps 4, 5, and 6 must be done from a clean device — not the computer the scammer used.

1. Cut the internet connection.

Unplug the Ethernet cable. Or turn off the Wi-Fi. Or turn off the home router if you are acting from a distance. Do this now, while the caller may still be connected. While they are connected, they can see the screen and reach files.

2. Hang up and stop all contact.

Hang up. Stop replying to texts or chats. Do not call back.

If they call again, do not explain. An explanation gives them another chance to pressure your parent.

A real company will not mind if you hang up and call back on a number you already have.

3. Write down what happened.

Do this before the details blur. Write:

• The phone number that called, or the website that was visited
• Any name the caller used
• What software was installed, if you know
• Whether money was paid, and how (gift card, wire transfer, Zelle, credit card)
• Whether your parent logged into their bank, email, or other accounts while connected
• Whether any identity documents were on screen — passport, Social Security card
• The approximate start and end time

This record helps the bank, law enforcement, and whoever cleans up the computer.

4. Call the bank. Use the number on the card or statement.

Do not use any number the scammer gave or left on screen. Tell the bank: "A tech-support scammer had remote access to the computer. Banking information may have been visible."

Ask about card replacement, transaction disputes, account monitoring, and whether any recent transfers can be reversed. If your parent logged into the bank while the caller was connected, tell the bank that specifically.

One technique CISA described in a 2023 advisory on remote-access scams: after connecting, a caller gets a person to log into their bank account. The caller then alters the account display on screen to make it look as if the bank has sent a large refund. They ask the person to send back the extra — but the money sent is the person's own. If your parent sent money this way, tell the bank right away.

5. Change the email password from a clean device.

Email controls account recovery for almost everything else. Use a phone, tablet, or a different computer — not the one the scammer touched.

Change the email password. Turn on two-step verification if it is not already on. Check recovery settings: backup phone numbers, recovery email addresses, and any apps connected to the account. If your parent logged into email while the scammer was watching, treat that password as already known to the caller.

6. Change passwords for financial and identity accounts.

Still from the clean device, change passwords for:

• Bank and credit card accounts
• Brokerage and retirement accounts
• Apple ID or Google account
• Social Security and IRS accounts if used online
• Microsoft account
• Password manager
• Health portals
• Shopping accounts

Also change any password that was the same as the email password.

After the first hour

Once the urgent steps are done, check these four things.

Email settings. Look for forwarding rules that were not there before, changed recovery contacts, and unfamiliar apps that have access to the account.

Installed software. Look for remote-access programs that were added during the session, such as AnyDesk, TeamViewer or ScreenConnect. These are real tools that scammers misuse. Uninstall anything that was added that day. Then run the security software already on the computer. Do not download a "cleaner" from any link sent after the scam.

Whether to rebuild the computer. A full wipe is not always necessary. Consider it if the scammer had administrator access, if files were downloaded or commands were run, if security settings were changed, if the computer is used for business or regulated data, or if the family cannot tell what changed. Write down what happened before wiping anything.

Whether a second call comes. After one scam, more calls may follow. They might say: "We can refund your money," "We are the fraud department," or "The first person was fake — I am the real one." Treat every follow-up as suspicious. Verify it through a number you already have, not one the caller gives you.

What not to do

• Do not change passwords from the computer the scammer used. It may still be compromised.
• Do not call back any number the scammer provided.
• Do not pay any follow-up "refund" request. That is the continuation of the scam, not a solution.
• Do not download any tool sent after the incident to "protect" or "clean" the computer.

Report it

Report the scam at ic3.gov, the FBI's Internet Crime Complaint Center. In 2025, the FBI recorded more than 21,000 tech and customer support scam complaints from people aged 60 and over, with more than $1 billion in reported losses. Reports help agencies identify patterns and warn others.

You can also file a report at ReportFraud.ftc.gov.

How to talk to your parent

These scammers are practiced. The calls are built to create fear and urgency, and to move faster than a person can think. Your parent is not unusual for being affected.

Do not lead with "How could you fall for that?" Lead with: "I'm glad you told me. Let's protect the accounts first."

Then ask neutral questions to build a timeline:

• What did they say was wrong with the computer?
• What did they ask you to install?
• Did they ask you to log into anything?
• Did they ask for payment or mention the bank?
• Did they say not to tell anyone?

You are gathering facts, not prosecuting a family member. Shame makes people slower to tell anyone, and the bank needs to hear quickly.

Once things are calm, print the fridge card together and write your number on it.

How Obsidian Ridge helps

Ridge Watch is managed monitoring for individuals' and families' computers. A 24/7 security operations centre reviews every alert. When they act on one, they may remediate it, note it, or take the computer offline to contain the problem. Taking a computer offline is one of those three outcomes, not what happens every time. A contained computer stays offline until we review it, within one business day.

Ridge Watch works on Windows and Mac computers.

On Windows Pro computers, Ridge Watch can also block remote-control programs nobody approved. Windows Home is not supported.

Ridge Watch cannot stop a phone call, or someone being talked into making a payment — by gift card, wire transfer, crypto, or logging into the bank for a "refund." On a computer without blocking, a remote-access tool a person lets in on purpose may not look like a threat; CISA notes that these tools generally do not trigger antivirus. Ridge Watch also does not cover phones or tablets.

For plans and prices, visit Ridge Watch.