Home › Guide › You gave a scammer access

You gave a scammer remote access — here's the first hour

Q: What is the very first thing to do?

Disconnect the computer from the internet — unplug the network cable or turn off Wi-Fi. That instantly cuts off any remote-access tool. Then stop any further payments and hang up on the scammer.

Q: My elderly parent gave a scammer access — what's the biggest risk?

Beyond the initial loss, the biggest risk is the callback: these crews often phone back days later posing as a refund or recovery service to take more. Anyone referencing a prior technician, a customer ID, or your computer's security is the scam continuing — hang up.

First: this happens to smart, careful people every day, and you're already doing the right thing by acting. Work these steps in order.

By the EnvyForensics team · General guidance, reviewed 2026.

The first hour, in order

Disconnect the computer from the internet. Unplug the network cable or turn off Wi-Fi. A remote-access tool can't reach the computer while it's offline — this stops active control instantly. (Don't shut it off yet if you might report this — just get it offline.)
Stop all payments. No more gift cards, no "refund" that asks you to send anything, no new charges. Legitimate refunds never work that way. Hang up on the scammer.
Secure your email first — from a different device. Use your phone or another computer, not the one they controlled. Change your email password and turn on two-step verification. Email is the reset path to everything else, so it comes first.
Then your bank and financial logins. If they had your bank or accounts on screen, call the bank's fraud line and change those passwords too. Watch for new payees or transfers.
Check your email settings for sabotage. Look for new forwarding rules, new "app passwords," or unfamiliar recent sign-ins — scammers plant these to keep reading your mail after you reset.

Expect a callback. These crews frequently phone back days later posing as a "refund department," "recovery service," your bank, or even law enforcement — to take more. Anyone referencing a prior technician, a "customer ID," a refund, or your computer's security is the same scam continuing. Hang up.

If it's an elderly parent

The callback risk is highest here, and shame keeps many victims from telling anyone. Be gentle — reassure them it wasn't their fault, help them through the steps above, and make sure they know that anyone calling about the computer from now on is the scam. If money changed hands or the scammer was in their bank or email, it's worth having the machine professionally checked and the accounts audited.

Want to be sure the door is shut?

We find every remote-access tool the scammer left, confirm what accounts were exposed, preserve evidence for your bank and the police, and lock out the callback.

See how it works

FAQ

What's the very first thing to do?

Disconnect from the internet — unplug the cable or turn off Wi-Fi. That instantly cuts off any remote tool. Then stop payments and hang up.

My parent gave a scammer access — biggest risk?

The callback. These crews phone back posing as a refund or recovery service to take more. Anyone referencing a prior technician or "customer ID" is the scam continuing — hang up.