Remote-access security: spotting and avoiding support scams

Remote-access software is a legitimate, essential IT tool — and the single most abused category in tech-support scams. Here's how the scams work and how to protect yourself and your users.

Why scammers love remote-access tools

These tools do exactly what a scammer wants: hand them full control of a victim's computer. The software itself is legitimate and widely trusted, which is precisely why it's effective as a weapon — the victim installs a real, reputable app, not obvious malware. Once connected, a scammer can view files, move money, install actual malware, or lock the machine for ransom.

How the typical scam works

1. First contact: an unsolicited phone call, a scary pop-up ("your computer is infected!"), or an email claiming to be from a bank, a well-known tech company, or "support".
2. Manufactured urgency: they insist something is badly wrong and must be fixed now.
3. The install: they direct you to download and run a remote-access tool and read out a code or click a link that grants them a session.
4. The payoff: with control of your screen, they "find" fake problems, demand payment, access bank accounts, or install malware. Some fake a refund and claim you were "overpaid" to extract money.

Warning signs

• You didn't initiate the contact
• Pressure and urgency — "act now or lose your data"
• A request to install software you've never heard of, or to read out a code
• Claims to be from "Microsoft", "your bank", "Amazon" or generic "tech support" out of the blue
• A request to log into your bank "to confirm the fix" or "process a refund"
• Requests for payment via gift cards, wire transfer or cryptocurrency

How to protect yourself

• Hang up / close the pop-up. Don't engage. Real support doesn't cold-call.
• Never grant access to an unsolicited contact. If in doubt, contact the company yourself using a number from their official website.
• Never share session codes or passwords with anyone you didn't contact.
• Enable MFA on your important accounts, especially banking and email.
• Keep unattended access locked down and remove tools you don't use.

If you've already been scammed

1. Disconnect the device from the internet immediately.
2. Uninstall the remote-access software they had you install.
3. Change passwords from a different, trusted device — starting with banking and email.
4. Contact your bank if you shared financial details or made any payment, and watch for unauthorised transactions.
5. Run a security scan, or have a trusted technician check the machine for malware.
6. Report it to the relevant authority in your country (for example, Action Fraud in the UK, or the FTC in the US) and to the impersonated company.

For IT teams and MSPs

Protecting users is part of deploying remote access responsibly: train staff on these warning signs, enforce MFA, lock down unattended access, keep audit logs, and make sure users know how your real support actually contacts them — so an impostor is easy to spot. See our secure setup guide.

Frequently asked questions