Remote-access banking scams: what to do immediately
Remote-access scams turn your own computer or phone into the criminal’s doorway. A caller may claim to be from a bank, broadband provider, software company or investment service and persuade you to install screen-control software so they can “fix” a problem or “help” with a payment.
Do not install remote-control software at the request of an unexpected caller. If you already did, disconnect the device from the network, end the remote session, contact your bank from a trusted device if banking was exposed, and run the security checks recommended by your operating system or security software.
The software can be legitimate while the use is fraudulent
Remote-support tools are genuinely used by IT teams. The scam is the social engineering around them: a stranger persuades you to grant control, then uses that access to view information, change screens or guide you through banking actions.
The name of a well-known remote-access product is therefore not reassurance. Ask why an unsolicited caller needs control of your device at all.
Practical checkpoint for remote-access software scams involving bank accounts: establish the starting position before you change anything. Use a caller who persuades someone to install remote-control software and then opens online banking as a worked example and write down software name, session time, bank logins, payees, transfers, browser history and any codes disclosed. That turns 'The software can be legitimate while the use is fraudulent' into a testable sequence rather than a vague problem.
Never log into online banking while a stranger can view or control the screen
If remote access is active, the other person may see account balances, payee details or authentication prompts. They may also obscure what is happening with windows or screens while asking you to focus on a different task.
A genuine bank does not need control of your computer to secure your bank account. End the session and use the bank’s official app or phone number yourself.
Run the numbers or sequence on paper before repeating the action. In the example of a caller who persuades someone to install remote-control software and then opens online banking, separate the amount, date, channel and decision point, then mark which part is confirmed and which part is still an assumption. For 'Never log into online banking while a stranger can view or control the screen', the useful question is not simply whether something can work, but what result you should see next and how long you are prepared to wait before changing route.
Second check for section 2, 'Never log into online banking while a stranger can view or control the screen': use a caller who persuades someone to install remote-control software and then opens online banking and write a one-line expected result beside the actual result. Then verify software name, session time, bank logins, payees, transfers, browser history and any codes disclosed. If the two do not match, pause rather than creating another transaction or application. Disconnect it, contact the bank from a separate trusted device and assess both financial activity and device security before resuming access.
If software was installed, treat the device and the banking session separately
The NCSC advises people who followed instructions to install suspicious software to run a full antivirus scan and allow the security software to clean detected problems. If banking details were also exposed, contact the bank immediately rather than waiting for the computer scan to finish.
Use another trusted device for the bank call or password changes if you believe the original device may still be controlled or monitored.
Use a controlled process for 'If software was installed, treat the device and the banking session separately'. Gather software name, session time, bank logins, payees, transfers, browser history and any codes disclosed, take one deliberate action, and record the result before trying a second route. Do not reconnect the device to banking simply because the remote session appears closed. If the first route clearly cannot complete the job, disconnect it, contact the bank from a separate trusted device and assess both financial activity and device security before resuming access rather than improvising with an unverified workaround.
Check what financial actions occurred during the session
Review new payees, bank transfers, card transactions and security changes. Do not look only for money leaving the account: a criminal may first add a beneficiary, change contact details or gather information for a later attack.
If you see an unauthorised payment, report it as such. If you were talked into making the transfer yourself, explain that it was a scam-induced payment so the bank can assess the correct fraud process.
Build a failure plan before the deadline matters. For remote-access software scams involving bank accounts, decide what you will do if the normal route fails at the worst reasonable moment: a bill is due, a payment is time-critical, a phone is unavailable or verification will not complete. Keep enough time and money outside the process to recover. Under 'Check what financial actions occurred during the session', note the exact error or refusal wording because that is usually more useful to support than a general statement that it did not work.
Expect follow-up attempts after you cut access
The fraudster may call again claiming that disconnecting damaged the refund process or that another technician must finish the work. Do not reinstall software or pay a fee to “close” the case.
Change compromised passwords, especially reused ones, and review email security because email access can support future account resets.
Treat evidence as part of the solution, not paperwork added afterwards. For 'Expect follow-up attempts after you cut access', keep software name, session time, bank logins, payees, transfers, browser history and any codes disclosed in one dated folder and write a two-line chronology of each contact. Do not reconnect the device to banking simply because the remote session appears closed, and use only a channel you reached independently when security or fraud is involved.
Second check for section 5, 'Expect follow-up attempts after you cut access': use a caller who persuades someone to install remote-control software and then opens online banking and write a one-line expected result beside the actual result. Then verify software name, session time, bank logins, payees, transfers, browser history and any codes disclosed. If the two do not match, pause rather than creating another transaction or application. Disconnect it, contact the bank from a separate trusted device and assess both financial activity and device security before resuming access.
Remote access can expose far more than the bank app
Tools such as AnyDesk, TeamViewer or other remote-control applications can allow a scammer to view the screen, move the pointer, read security messages and see email or password-manager content. If a caller persuaded you to install one, disconnect the device from the internet and use another trusted device to contact the bank. Do not let the same caller guide you through uninstalling it while they still have access.
Treat the email account and browser as potentially exposed too. Change important passwords from a clean device, sign out unknown sessions and check whether email forwarding rules or new recovery addresses were added. NCSC device-recovery guidance recommends a full security response where remote access or malware may have been installed, because deleting the visible app icon does not prove the device is clean.
If money was transferred, give the bank the exact payment references and explain that remote access was involved. Preserve the software name, session time, caller number and any chat transcript. That evidence can help separate an APP scam you were coached into approving from a transfer the attacker initiated without your permission.
Finish with a decision rule for remote-access software scams involving bank accounts. In the worked example of a caller who persuades someone to install remote-control software and then opens online banking, the safer next step is the one that preserves evidence and keeps essential money or account access recoverable. If the provider cannot explain the next step clearly, disconnect it, contact the bank from a separate trusted device and assess both financial activity and device security before resuming access and keep the case reference until the outcome is reconciled.
Sources and verification
Victoria Hughes - Consumer Rights Specialist
The dangerous permission is not the download itself but handing a stranger visibility and control while financial accounts are open. Once an unexpected caller asks for remote access, the safest support session is the one you do not start.
MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.