Tech support scam: what to do if a caller says your computer is hacked

The phone rings, or a loud pop-up fills your screen. Someone says your internet connection has been hacked, or that your computer is infected, and that they can fix it if you let them connect to it. It sounds helpful. It is a well-known way to get at your bank account. This guide pulls together what Take Five and the National Cyber Security Centre (NCSC) say, so you know what to do before, during and after.

How the scam works

Take Five describes impersonation scams as criminals posing as a trusted organisation, such as your bank, the police or HMRC, to get money or details out of you. One of its examples fits this scam closely: a woman was told her internet connection had been hacked and was asked to grant remote access to her computer. The callers then offered £500 in compensation, and she gave her bank details. Her money was later moved to another account.

The NCSC describes the same pattern: someone calls to say your device is infected and offers to help, often impersonating Microsoft or your internet provider. It calls this a common scam.

Take Five also explains why remote access matters. On its banking fraud page it says criminals may pose as internet service provider support and persuade you to install software that gives them control of your computer, then use that control to reach your accounts.

What to do while the call is happening

• Hang up immediately. This is the NCSC's own wording.
• Never let someone you did not expect to call gain remote access to your computer or phone.
• If a caller claims to be from a trusted organisation, hang up and call back on a number you know is correct, not one they gave you.
• Remember that knowing some of your personal information does not mean someone is genuine.
• Ignore pressure. Take Five says that only criminals will try to rush or panic you, and that it is fine to reject, refuse or ignore a request.

If you already gave access or paid

Move fast, in this order:

1. Stop sending money or information.
2. Contact your bank immediately, using a trusted number such as the one on your card, or call 159.
3. Change the passwords for affected accounts and turn on 2-step verification.
4. Save evidence: messages, phone numbers, website addresses and payment details.
5. Report it to the police at reportfraud.police.uk or on 0300 123 2040. The NCSC also says to report the call to Report Fraud.
6. Watch for follow-up scams, where criminals offer to recover your money for a fee.

Clean the device

The NCSC gives a three-step approach for an infected device. First confirm it really is infected. Signs include slowness, unexplained reboots, programs opening or closing on their own and unfamiliar pop-ups. Then try to fix it:

• On phones and tablets, antivirus usually cannot fix the problem. The safest option is a factory reset from Settings.
• On PCs and laptops, update the device and its programs, run an antivirus scan and follow its advice. If that fails, wipe the device completely and reinstall everything, starting with the operating system. You may need expert help.
• Restore from your last known good backup. The NCSC warns against trying to rescue files from a device that is still infected.

Afterwards, keep devices and apps updated, back up your data regularly, check that the device is encrypted and use antivirus that updates regularly on PCs and laptops.

Where Remove Me fits in

Remove Me offers a free scan with no account needed. You enter your details and the service searches publicly visible web results, known public data breaches (Have I Been Pwned) and a register of data brokers, then shows a report. The report is unlocked with a 6-digit code sent by email. Remove Me does not yet send erasure requests on your behalf.

What the sources do not say

Neither Take Five nor the NCSC says how to recover money that has left your account, or how a bank decides on a refund. Speak to your bank about that.