I installed something or let somebody control my screen
Remote access sees everything: what you type, what you open, and every phrase or code that passes through the machine.
- Disconnect the device from the network Wi-Fi off, cable out. This ends the session immediately, which matters more than anything you could uninstall first.
- Move funds from a different device A phone that was never involved, or somebody else's computer. Assume the affected machine cannot be trusted for anything, including reading an address correctly.
- Assume every phrase and password on that machine is exposed Screenshots, keystrokes, clipboard, password manager, browser sessions, files named "backup". If a recovery phrase was ever on it — typed, photographed or stored — the wallet must be replaced.
- Remove the remote-access software, then rebuild rather than repair Uninstall what was installed, then treat a full reinstall of the operating system as the reliable answer. Cleaning a machine somebody else controlled is a guess.
- Change passwords from a clean device, email first Then sign out all sessions everywhere, and check email filters and forwarding rules for anything added.
- Check bank and exchange accounts for changes, not just theft New payees, new API keys, altered contact details, removed second factors. The theft sometimes comes days later, from the door that was left open.
Why this one is different
Most incidents on this page compromise one secret. Remote access compromises the environment where all your secrets live, which is why the response is broader and duller: rebuild the machine, replace the wallets, rotate the credentials.
The conversation that led here
"Let me just check the settings for you" is the standard line, from support that contacted you first, a caller from your bank, or someone helping in a chat group. Real support does not initiate contact and never needs your screen — fake support and impersonation covers the pattern in full.
If money already moved
If your funds are gone for the first hour, and the account version if a login was involved rather than a wallet.
Anyone who contacts you offering to recover this is the next thief
It follows losses within days, sometimes hours, and it copies the names of real firms, regulators and police units. Nobody legitimate finds you first. How the recovery scam works →
Last checked 19 Oct 2026. This page is procedure, not legal advice — what a report achieves depends on where you live.