What to do after a fake tech support call, pop-up, or remote access scam
Fake tech support scams use virus pop-ups, security warnings, phone calls, invoices, and remote-access tools to make you believe someone is fixing a device or account. What matters now is what you clicked, installed, showed, paid, or allowed them to control.
By ScamClarity Editorial Team
Reviewed by ScamClarity Safety Review
Published May 20, 2026 · Updated May 20, 2026
A tech support scam usually starts by making you believe something is wrong with your device, account, subscription, payment, or security software. The goal is to get you on the phone, inside a remote-access session, or into a payment before you can verify what is real.
The safest response depends on what happened. Seeing a scary pop-up is different from letting someone control your screen. Calling a number is different from opening your bank account while the caller is watching. Use the closest situation below, then keep reading for the details that matter most.
First, identify what happened
If more than one applies, start with the situation involving remote access, money, passwords, sensitive information, or a work or school device.
I only saw a pop-up or warning
Lower risk
A fake virus warning is often just a web page trying to scare you into calling. It is not proof that your device is infected.
Close the tab or browser window. If it will not close, restart the browser or device. Do not call the number in the warning.
Look for a downloaded file, app, browser extension, or permission prompt only if you clicked past the warning.
If the same warning keeps returning on one site, avoid that site and clear the browser tab or session.
Do not: Do not use the phone number, link, or chat box inside the warning to prove it is real.
I called the number but did not allow access or pay
Check closely
The call itself is usually less serious than remote access or payment, but the caller may keep trying to pull you back in.
End the call. Do not call the same number back. If you shared your name, phone number, or email, expect possible follow-up calls or messages.
Think through whether you gave a password, one-time code, card number, address, date of birth, or bank information.
If you were told to keep the call secret or not talk to your bank or family, treat that as pressure, not support.
Do not: Do not accept a refund call or callback from the same person or number.
I allowed remote access
Act quickly
Remote access changes the risk because the person may have seen your screen, opened files, changed settings, installed tools, or watched you sign in.
Disconnect the session, remove the remote-access tool, and use a trusted device for password and payment-account changes.
List what was open on screen: email, banking, password manager, tax files, photos, cloud storage, or work systems.
Check whether the caller installed AnyDesk, TeamViewer, UltraViewer, Quick Assist, ScreenConnect, LogMeIn, or a similar tool.
Contact work or school IT if the device or account is managed by them.
Do not: Do not reconnect because the caller says they need to finish a refund, cleanup, or cancellation.
I installed remote-access software
Act quickly
The software may be legitimate, but in this situation it was used to give the wrong person a way into your device.
Remove the software and check for other new apps, browser extensions, profiles, startup items, or permissions you did not add yourself.
Restart the device after removing the tool.
Run trusted security software and review anything it flags.
If the tool appears again after removal, get help from a trusted local repair provider or the device maker's official support.
Do not: Do not leave the tool installed just because the caller said it was temporary.
I entered a password or one-time code
Act quickly
A password can let someone sign in. A one-time code can approve a login, reset, device enrollment, or payment.
Change the password from the real app or website, preferably from a trusted device. If you reused the password, change it on those accounts too.
Review active sessions, recovery email and phone, forwarding rules, connected apps, app passwords, and recent security alerts.
If the account is Microsoft, Apple, Google, bank, email, or workplace-related, use that provider's official account security page.
Do not: Do not share another code with someone who says they are undoing the problem.
They saw banking, email, files, photos, or personal information
Check closely
Visible information matters. The risk is higher if the caller saw account numbers, SSNs, tax files, IDs, saved passwords, private photos, or cloud files.
Write down what was visible, then review the accounts or documents that were open. Contact the bank, card issuer, or account provider if financial details were visible.
Check email for new forwarding rules, deleted security alerts, password reset messages, or unfamiliar sent messages.
Check cloud storage and password managers if they were open or unlocked.
Use IdentityTheft.gov if Social Security numbers or identity documents were exposed or misused.
Do not: Do not assume every private file was copied, but do not ignore what was actually open or unlocked.
I paid
Urgent
Money movement is time-sensitive. The provider that handled the payment controls the charge, transfer, dispute, card replacement, or account lock options.
Contact the card issuer, bank, payment app, wire company, gift card issuer, PayPal, or crypto platform using the official app, website, or known phone number.
Save receipts, transaction IDs, gift card numbers, wallet addresses, emails, invoices, phone numbers, and dates.
Ask the provider what can be blocked, reversed, disputed, replaced, or monitored.
Do not: Do not pay a recovery service or a caller who says another payment is needed to release a refund.
My device or account seems different
Check closely
Some changes matter more than general slowness. Focus on new software, new browser behavior, account changes, payment activity, and signs someone else signed in.
Watch for pop-ups that return after restart, unknown remote-access tools, changed passwords, new forwarding rules, or unfamiliar devices.
If a work or school system was involved, report it internally instead of trying to clean it up alone.
Do not: Do not wipe the device before saving evidence if money, threats, or a police or provider report is involved, unless trusted support tells you to.
I need to report it
Check closely
Reporting is still useful even if you did not lose money. The right place depends on whether this involved fraud, internet crime, payment, impersonation, or a managed device.
Save evidence first, then report through the official destination that matches what happened.
Use ReportFraud.ftc.gov for consumer fraud and tech support scam reports.
Use IC3.gov for internet-enabled crime or fraud reports.
Contact the payment provider, platform, device maker, employer, or school when their account, device, or payment system was involved.
Do not: Do not paste full SSNs, full card numbers, passwords, or private account screenshots into public forums or random helper tools.
Remote access changes the risk
Tech support scams are not only about a fake virus warning. The bigger question is whether someone controlled your screen or watched while you used your accounts. Remote access lets another person move the mouse, type, open windows, and sometimes transfer files or install software.
That does not mean they definitely stole everything. It means you should focus on what they could actually see or touch. A browser tab with your bank open matters more than a blank desktop. An unlocked password manager matters more than a closed app. A work laptop matters differently from a personal tablet.
Remote-access tools are used by real support teams, but they are risky when an unexpected caller or pop-up told you to install them.
End the session and do not reconnect
Close the session, hang up, and do not approve a new connection request.
Remove the remote-access tool
Look for AnyDesk, TeamViewer, UltraViewer, Quick Assist, ScreenConnect, LogMeIn, or other tools you do not use.
Review apps, extensions, profiles, and startup items
Check whether anything else was installed while the caller had access.
Restart and scan
Restart the device and run trusted security software. Use the software you already trust or the security tools built into the device.
Change exposed passwords from a trusted device
Start with email, banking, Apple, Microsoft, Google, password manager, payment apps, and any account that was open on screen.
Contact the provider when money or managed systems were involved
Call the bank, card issuer, payment provider, employer, or school through a known number or official site.
If the device is managed by work or school, stop here and contact the right support team. They may need logs or device details before anything is removed.
If money was paid
Contact the payment provider first. ScamClarity can explain common next steps, but the provider controls whether a card can be replaced, a charge can be disputed, an account can be locked, or a transfer can be reviewed.
Credit or debit card: call the issuer, ask about dispute options, card replacement, recurring charges, and account monitoring.
Gift card: keep the card and receipt, then contact the gift card issuer quickly. Do not send the card photos to anyone else.
Bank transfer, wire, Zelle, or payment app: contact the bank or app support through the official app or website and ask what can be stopped, reversed, or documented.
PayPal or an invoice platform: open the official app or website yourself and report the transaction there.
Crypto: save the wallet address, transaction hash, amount, date, and platform. Recovery promises are often another scam.
If the caller says you were refunded too much, that is a common refund-scam move. Do not send money back, buy gift cards, move money to a safer account, or transfer funds to a person who is still on the phone with you.
If personal or account information was visible
A remote-access session can expose information even if you never typed it into a fake form. Treat anything open, unlocked, copied, photographed, or spoken aloud as possible exposure. Focus on the most useful account checks first.
Banking or card screens: contact the financial provider and review recent and pending activity.
Email inbox: check recovery settings, forwarding rules, deleted messages, sent messages, and recent sign-ins.
Password manager or browser passwords: change the accounts that were visible or autofilled and review connected devices.
SSN, tax forms, IDs, or identity documents: use IdentityTheft.gov if identity theft or misuse applies.
Cloud files, photos, or backups: check account sessions, sharing settings, recent activity, and unfamiliar devices.
What the scammer wanted from you
What they pushed
Why it mattered
Best first move
Call a support number
Moves you from a warning screen into a controlled conversation
Hang up and use the official company site or app
Install remote access
Lets the caller control or view the device
Disconnect, remove the tool, and check what was exposed
Show a banking screen
Helps them pressure, transfer, or gather account details
Contact the financial provider using a known number
Buy gift cards
Turns money into codes that are hard to recover
Keep the cards and receipts and call the issuer quickly
Share a one-time code
May approve a login, reset, enrollment, or payment
Treat the code as account access and review that account
Pay an invoice or refund
Creates a fake reason to send money or expose payment details
Verify through the official provider, not the caller
Keep the call secret
Cuts you off from people who might spot the scam
Pause and talk to a trusted person or official provider
Use this as a map of what to check. The same scam may use more than one tactic.
What not to do now
Do not call the same number back, even if the caller sounded professional.
Do not reconnect remote access for a refund, cancellation, cleanup, or security check.
Do not pay a recovery service that promises to get money back.
Do not share more one-time codes, passwords, card numbers, or bank details.
Do not trust a refund promise from the same caller or company name used in the scam.
Do not use the suspicious pop-up, invoice, or email to verify the company.
Do not wipe the device before saving payment evidence if you need to report or dispute the fraud, unless a trusted provider tells you to.
What to save before reporting
Save enough to explain what happened without sharing private information publicly.
Caller and company details
Phone numbers, caller names, company names, websites, chat handles, and email addresses used.
Remote-access details
Tool name, session IDs if visible, screenshots, download names, and approximate connection times.
Payment proof
Receipts, transaction IDs, gift card receipts, gift card numbers, wallet addresses, invoice numbers, and dates.
Account and device changes
New apps, browser extensions, changed passwords, new recovery details, forwarding rules, unknown sign-ins, or security alerts.
What they saw or opened
Bank pages, email, password manager, tax files, cloud storage, photos, work apps, or personal documents.
Keep full SSNs, full card numbers, passwords, and private screenshots out of public posts or random helper chats.
Where to report a tech support scam
Report through official channels. ScamClarity is not a government reporting destination and cannot recover money. The right place depends on what happened.
FBI IC3: internet-enabled crime or fraud, especially when remote access, wire transfers, crypto, or large losses are involved.
Bank, card issuer, payment app, wire company, gift card issuer, PayPal, or crypto platform: payment disputes, account locks, transaction review, and card replacement.
Microsoft or Apple official support: account security or brand impersonation involving those accounts or devices.
Remote-access provider abuse reporting: suspicious use of a remote-access tool, if the provider offers a reporting channel.
Work or school IT: any managed device, managed account, employer email, school login, or internal system.
Local police or 911: threats, immediate danger, local theft, or someone trying to pick up cash, gold, cards, or devices in person.
Official sources used
The FTC sources support the fake pop-up, fake support call, payment, and reporting guidance. FBI and IC3 sources support internet-enabled crime reporting, evidence retention, and remote-access risk. Microsoft and Apple sources support the guidance about official support channels, fake warning messages, passwords, codes, and account security.
Official links
Use these as official starting points when the situation applies.
Apple impersonation, phony support calls, suspicious pop-ups, passwords, security codes, and official support channels.
FAQ
Does Microsoft or Apple call about viruses?
Treat an unexpected call about a virus, hacked device, expired security software, or urgent account problem as suspicious. Microsoft and Apple both direct users to official support channels and warn against unsolicited support calls or suspicious pop-ups.
Is a fake virus pop-up proof my computer is infected?
No. A scary pop-up can be a web page designed to make you call. Close the browser or restart the device. If you downloaded something, installed software, or the warning returns outside the browser, check the device more closely.
What if I called but did not give access?
End the contact and do not call back. Review whether you shared a password, code, payment detail, address, or other private information. If you only talked and shared nothing sensitive, the main risk is follow-up pressure.
What if I gave remote access?
Disconnect, remove the remote-access software, and focus on what was visible or open. Change exposed passwords from a trusted device, contact financial providers if money or bank screens were involved, and contact work or school IT for managed devices.
Should I reset my computer after a tech support scam?
Not always. Start by disconnecting remote access, removing the tool, scanning with trusted security software, and reviewing what changed. A reset may be appropriate if unknown software remains, access keeps returning, or a trusted support provider recommends it.
What if the scammer saw my bank account?
Contact the bank using the official app, website, statement number, or card number. Tell them a scammer viewed the account during a remote-access session and ask what should be monitored, blocked, replaced, or documented.
Can I get money back after paying fake tech support?
It depends on the payment method and how quickly you contact the provider. Cards and some platforms may have dispute or replacement options. Gift cards, wires, payment apps, and crypto can be harder. Do not pay anyone who promises guaranteed recovery.
Where do I report a tech support scam?
Use ReportFraud.ftc.gov for consumer fraud and IC3.gov for internet-enabled crime or fraud. Also contact the bank, card issuer, payment app, device maker, remote-access provider, employer, or school when their account, payment system, or device was involved.