Someone has remote access to my computer: cut it off, in order

Whether you let a 'support technician' in during a scam call, or the mouse moves when you're not touching it, treat remote access as urgent but fixable. The order below matters: disconnect first so nothing can watch or interfere while you clean up, remove the access tools, scan, then re-secure accounts from the cleaned machine (or a different device).

Cut it off

  1. Disconnect the internet now — unplug ethernet / turn off Wi-Fi. This ends any live session and blocks reconnection while you work.
  2. Uninstall every remote-access tool you don't personally use: Settings → Apps (Windows) or Applications (Mac). Names include AnyDesk, TeamViewer, UltraViewer, LogMeIn / GoToAssist, Splashtop, ScreenConnect (ConnectWise Control), Zoho Assist, RemotePC. If a scammer installed it, it goes — legitimate tools can always be reinstalled later.
  3. Run a full antivirus scan (Windows Security → Full scan, then Microsoft Defender Offline scan). On Mac, remove any 'cleaner'/profile installed during the session (System Settings → General → Device Management — delete profiles you don't recognise).
  4. Check what starts with the computer (Task Manager → Startup on Windows) and disable anything unknown.
  5. Reconnect only after the scan is clean.

Then re-secure your accounts

  1. From this cleaned machine or a different device: change passwords — email first, then banking, then the rest — and switch on two-factor authentication.
  2. Call your bank if banking was accessed or any payment was made; ask about monitoring and disputing scam-session charges.
  3. Check sent email and account activity for changes you didn't make (forwarding rules, new payees, recovery info).
How it usually starts: a pop-up, a fake renewal email, or a search ad for a support number leads to a call where you're walked through installing the remote tool yourself. Removing the tool and changing passwords closes the door they used — see how the pop-up scam runs so the next one is obvious.

Common questions

How can I tell if someone is connected right now? Look for remote-tool icons in the system tray/notification area (AnyDesk, TeamViewer, UltraViewer, LogMeIn, Splashtop), a banner saying a session is active, or the cursor moving and windows opening on their own. Absent those, a past session ended when the tool closed — but if the tool is set to start with Windows with unattended access, it can return; that's why uninstalling beats just closing.

They only 'looked at' my screen. Do I still need all this? Yes for the uninstall and scan — screen-sharing sessions can also transfer files and plant a persistent access tool in minutes. Password changes are the judgement call: if banking or email was open or typed during the session, change them.

Related

Tech support scam pop-ups · Fake Windows Defender warning · Fake Error #268D3 · Fake ZEUS virus pop-up · Fake blue screen scam · Fake renewal email scam · Clicked a phishing link? · Fake Apple security warning · "Your computer has been locked" scam · Social Security scam calls · Fake Amazon account alerts · Someone has remote access to my computer