Remote access scams are one of the most damaging forms of cybercrime targeting Australian households and businesses. A scammer convinces you — often posing as a technician from Telstra, Microsoft, the NBN, or a government agency — to install software that gives them direct control of your computer. Once they have access, they can steal banking credentials, install malware, transfer money, and lock you out entirely.
If this has happened to you, the instinct is often to freeze or hope nothing serious was done. That’s the wrong response. Every minute a scammer retains access or has recently had it, the damage potential compounds. Here is what to do, in the right order.
Step 1: Disconnect From the Internet Immediately
The moment you suspect a scammer has or recently had remote access, disconnect your computer from the internet. Physically unplug the Ethernet cable or turn off the WiFi from the hardware switch if your device has one. Do not just close the remote access application — do this first.
This is the single most important action because:
- It immediately terminates any active remote connection
- It prevents any malware they may have installed from “calling home” or downloading additional components
- It stops any automated data exfiltration in progress
Do not reconnect to the internet until you have completed the steps below.
Step 2: Do Not Pay or Transfer Any Money
If the scammer is still trying to convince you to pay — either for “services” or by claiming they’ve done something to your computer that will be reversed if you pay — stop all communication. Do not call them back. Do not click any links they’ve sent. Do not follow any on-screen instructions they may have left.
Scammers often create artificial urgency (“your computer is infected, and we need to finish the removal”) or threats (“we’ll delete your files”) to pressure payment. None of these threats is legitimate, and paying doesn’t undo the access they’ve already had.
Step 3: Uninstall the Remote Access Software
Remote access scams typically use legitimate remote desktop tools — AnyDesk, TeamViewer, AeroAdmin, and similar programs are common. These are real, legitimate software products that scammers abuse. You need to remove whichever tool was installed.
On Windows: Go to Settings > Apps, find the remote access software, and uninstall it. Also, check the system tray for any running instances.
On Mac: Go to Applications, find the software, drag it to Trash, and empty the Trash. Check System Preferences > Sharing to confirm Remote Management is disabled.
After uninstalling, run a full check of your startup programs and scheduled tasks — scammers sometimes add items here to maintain persistence after you close the initial connection.
Step 4: Change All Your Passwords — From a Different Device
This is critical and must be done from a different device (phone, tablet, or another computer) that was not compromised. Do not use the affected computer until it has been professionally assessed.
Change in this order:
- Email accounts — these are the keys to every other account (password resets all go through email)
- Online banking and financial accounts
- Government services — myGov, ATO portal
- Any other accounts you were logged into during the period of access
Enable two-factor authentication on all accounts where it’s available. This means even if the scammer captured a password, they can’t use it without the second factor.
Step 5: Contact Your Bank Immediately
Call your bank’s fraud line as soon as possible — most major Australian banks have 24/7 fraud lines. Tell them:
- You had remote access to your computer, and suspect your banking may have been viewed or accessed
- The approximate time and date the access occurred
- Whether you saw the scammer navigate to any banking sites during the session
Banks can place holds on transactions, monitor for suspicious activity, and, in some cases, reverse transfers that haven’t yet settled. Speed matters significantly here — the sooner you notify them, the more options they have.
If you transferred any money during the scam, believing it was legitimate, ask immediately about transaction reversal.
Step 6: Report the Scam
Report to the Australian Cyber Security Centre (ACSC) at ReportCyber (cyber.gov.au). You can also report to:
- Scamwatch (scamwatch.gov.au) — run by the ACCC
- Your local police, particularly if money was transferred
Reporting doesn’t just protect you — it helps authorities track patterns, identify scam operations, and warn others. You won’t get a call back in most cases, but the report contributes to the broader effort to shut these operations down.
Step 7: Have the Computer Professionally Assessed
This is where most people make a critical mistake — they assume that uninstalling the remote access software and running their existing antivirus software is sufficient. It often isn’t.
A sophisticated scammer who had access to your computer may have:
- Installed keylogging software that continues to record everything you type
- Created hidden user accounts for persistent access
- Modified system files to create backdoors
- Installed rootkits designed to survive standard antivirus scans
- Saved copies of your files, browsing history, or stored credentials
Standard antivirus tools can miss many of these. A professional assessment using specialised tools — and the expertise to know what to look for — is the only way to be confident the machine is clean.
professional virus and malware removal specifically covering the types of threats scammers install, as well as a full IT health check audit that examines your system for persistence mechanisms, hidden accounts, and unauthorised changes.
Step 8: Consider a Full Reinstall
In severe cases — where the scammer had extended access, where you can’t determine what was installed, or where suspicious behaviour continues after initial clean-up — the most reliable resolution is a full operating system reinstall.
This removes everything, including any malware that has embedded itself at the system level. It’s a more significant step, but it provides certainty that no remnants remain.
Before a reinstall, ensure your important files are backed up. If there’s concern that files on the machine may already be compromised or contain malware, professional guidance on what to back up (and how to do so safely) is advisable. data backup and recovery as part of the remediation process.
How to Recognise a Remote Access Scam Before It Happens?
Understanding the warning signs prevents the situation from arising in the first place. Remote access scams follow recognisable patterns:
Unsolicited contact claiming a problem exists: Legitimate companies like Microsoft, Telstra, or the NBN do not proactively call you to tell you your computer has a problem. If someone calls claiming this, it is a scam.
Urgency and pressure. Scammers create time pressure (“this needs to be fixed now or your computer will be infected/shut down/hacked”). Legitimate technicians don’t behave this way.
Requests to install software to “fix” the problem: Any caller asking you to install AnyDesk, TeamViewer, or similar software to allow them to “fix” your computer is running a scam.
Claims to be from government agencies: The ATO, Services Australia, and the NBN do not call demanding immediate action or requesting remote access.
Asking you to log into your bank: No legitimate technician needs you to log into your bank account during a computer repair session.
The broader landscape of tech scams and common online scams is worth understanding — remote access scams are one of several related threat types that follow similar social engineering patterns.
For Businesses: Additional Steps
If the compromised computer is part of a business network, the stakes are significantly higher. A scammer who accessed one machine on your network may have been able to move laterally to other systems, access shared drives, or compromise network credentials.
Isolate the affected machine from the network immediately — don’t just disconnect it from the internet, disconnect it from the local network too.
Check other machines for signs of compromise, unexpected software installations, or unusual behaviour.
Review network logs for unusual traffic or connections during the period of access if your router or managed services support this.
Contact your IT support immediately. For businesses with managed IT, this is exactly the kind of incident your provider needs to know about urgently. Managed IT services include incident response as part of ongoing support — if you don’t currently have this in place, a remote access incident is a strong signal that you should.
The long-term answer for businesses is a cybersecurity solutions review that addresses endpoint protection, access controls, staff awareness training, and incident response planning. A reactive approach to cybersecurity leaves you perpetually behind the threat.
Protect Yourself Going Forward
Once the immediate situation is resolved:
Install reputable antivirus software and keep it updated. Antivirus installation and setup from a professional ensures it’s configured correctly, not just present.
Enable two-factor authentication on all important accounts if you haven’t already.
Be sceptical of unsolicited contact by phone, email, or pop-up claiming your computer has a problem. When in doubt, hang up and call the organisation directly using a number from their official website.
Educate household members — elderly relatives are disproportionately targeted by these scams. If you have family members who are less confident with technology, making sure they know never to install software for someone who calls them unexpectedly could save significant financial and personal damage.
If you’ve been through a remote access scam and want a professional assessment of your computer’s current state, contact Computer Cures to arrange an inspection. We can determine what was installed, what was accessed, and what needs to be done to restore confidence that your machine is clean.
