Situation · Fake tech support
Fake tech support: what to do after remote access
If you called a number shown in an alert and installed a remote control tool, end the session, stop all contact with the caller and note the name of the software used. Don’t reset the device yet if checks still need to be carried out.
Practical sheet · ~6 min read · we will never ask for your codes.
Do this right away
Three steps, in order: end the remote access: close the control software and disconnect from the internet if the access is still active, then restart; don’t pay anything more and don’t call back the number shown; and if a payment, a card or a transfer was used, call your bank. Don’t delete anything for now: the traces are useful.
Recognising the situation
The scenario is almost always the same. If several of these signs ring a bell, you are probably dealing with fake support.
A fake alert
A blocking screen, a beep, a “virus detected” window in the name of Microsoft, Apple or an antivirus, with a number to call “urgently”.
A “technician” on the phone
A reassuring yet insistent voice that guides you step by step, wins your trust and asks you to install a tool to “fix” things.
Remote access
AnyDesk, RemotePC, TeamViewer, Supremo, RustDesk, Chrome Remote Desktop… software that gave access to your screen and your computer.
Accounts opened during the call
Email, bank, browser, cloud or government services accounts viewed in front of the scammer while they had control.
A payment requested
A “repair”, a “protection” subscription, a card number to give, a transfer or a PCS voucher presented as essential.
Access that can remain
Even after the call has ended, installed software, a service or an extension can allow a reconnection. Uninstalling what you can see is not enough.
Act fast, but in the right order
Six stages, from the most urgent to the most considered. The right order avoids two common mistakes: leaving an access active, or deleting useful items too soon.
What to check on the computer
Cleaning up is not just deleting an icon from the desktop. Check recently installed apps, especially remote control tools (AnyDesk, RemotePC, TeamViewer, Supremo, RustDesk, Zoho Assist, LogMeIn, Splashtop, Chrome Remote Desktop, VNC, ScreenConnect); startup programs, services and scheduled tasks; browser extensions added during the incident; recent downloads and fake “cleaners”; and finally the status of your antivirus, firewall and updates.
The accounts to check, from a clean device
Prioritise, in this order: your main email (it is the key to all your accounts), your bank and mobile payments, your Microsoft, Google or Apple accounts, then PayPal, Amazon and your phone operator, and finally your password manager. Change the passwords of the accounts opened during the call, turn on two-factor authentication, and sign out of sessions you don’t recognise. Do it from a trusted device, not from the computer that is still suspect.
Bank, police report and reporting
Depending on what happened, some official steps are useful. They are free and can be combined: a report is not a police report.
Your bank
If a payment, a card, a transfer or a mobile wallet was used: block it without delay, dispute the transaction in writing and ask for a refund. An unauthorised transaction is in principle refunded, unless there was gross negligence on your part (assessed case by case).
Dispute a bank transaction →Police report
If you have suffered a loss (payment, exposed data), file a police report: at a police station or gendarmerie, or online. For card fraud, a Perceval report accompanies the procedure.
Filing a police report & reporting →Reporting
Report the scam on Cybermalveillance.gouv.fr: this feeds the fight against these networks and points you to the right contacts, even without a police report.
cybermalveillance.gouv.fr →What makes things worse
A few reflexes, often driven by panic, weaken your file or leave the door open. Knowing them already helps you avoid them.
Thinking uninstalling is enough
Removing AnyDesk doesn’t solve everything: other access, services, extensions or accounts may remain exposed. Uninstalling is one step, not a full diagnosis.
Relying on the antivirus alone
A scan is useful, but it doesn’t check compromised accounts, email rules, payments or the evidence needed for a file.
Wiping in a panic
Erasing everything feels reassuring, but a hasty wipe loses traces that help to understand what happened and to support any police report. Assess the risk first.
Giving a code again “to check”
Never hand over a code received by text, a password, a recovery phrase or a full card number. Genuine support never asks for them, and don’t call back the number shown.
Not sure? Start with the free diagnosis.
In a few minutes, you’ll know what to check and in what order, and then you decide whether you want an expert’s help. Galyct Perso checks, secures and documents things with you; we guarantee no result: no certainty that no data was seen, no identification of the culprit, no recovery of funds, and we will never ask for your codes. Your data stays in France.
More guides & situations
Depending on what was affected, these pages complete the work of regaining control, preserving evidence and your formal steps.
AnyDesk / fake support guide
The detailed step-by-step after remote access: checks on the PC, accounts, payments and evidence to keep.
Open the guide →Preserving evidence
Before cleaning up or wiping: what to capture and keep so you don’t weaken your case.
Open the guide →Dispute a bank transaction
Your rights after an unauthorised payment: the refund principle, why you should alert your bank straight away, and your options.
Open the guide →Hacked account
Email or social media hijacked after the call: regain access through the official channels and secure the rest.
Open the guide →Filing a police report & reporting
Police report, Perceval, Cybermalveillance.gouv.fr: what each service is for and in what order to act.
Open the guide →Immediate reflexes
The right steps in the first minutes, whatever the situation, to limit the damage.
Open the guide →