What to do if someone gave remote access to a 'tech support' scammer

• End the call and close the remote session if it's still open.
• Disconnect the computer from the internet: unplug the network cable and turn off Wi-Fi.
• Leave the computer on, but don't use it for anything else.
• Tell IT, or call our 24/7 line at (289) 582-9930, and say what happened, when, and what the person was asked to do.
• Write down everything you remember: the caller's name and number, the website or pop-up, which tool they installed, what they looked at, and whether you typed any passwords or banking details while they were connected.

Scammers typically use legitimate remote-support software, sometimes several tools at once, and may leave one behind for later. IT should check installed programs, running services, startup items and scheduled tasks for remote-access software nobody approved, and check for new user accounts. Also look for browser extensions and changes to security settings.

Removing the obvious tool isn't proof the computer is clean. While connected, the scammer could run other software, copy files or change settings.

• Use a different, trusted computer or phone, not the affected one.
• Email first: whoever controls your email can reset everything else.
• Then banking, payroll, accounting software and any password saved in the browser on the affected computer.
• Sign out all sessions on each account, and check that MFA settings haven't been changed.
• If it's a work computer, IT should revoke the user's Microsoft 365 or Google Workspace sessions and review sign-ins.
• Check email for new forwarding rules or filters.

Call your bank's fraud line right away if online banking was opened during the session, if any card or account numbers were typed or visible, or if you sent money, bought gift cards or cryptocurrency at the caller's direction. Ask the bank to watch or freeze the accounts and to reverse anything unauthorized where possible.

If personal identity documents or SIN were visible on screen or in files, consider contacting Canada's credit bureaus about fraud alerts. If the computer held client or employee personal information, the incident may be a privacy breach that needs to be assessed and recorded.

Report the scam to the Canadian Anti-Fraud Centre, whether or not money was lost, through reportcyberandfraud.canada.ca or by phone at 1-888-495-8501. The CAFC shares information with the RCMP's National Cybercrime Coordination Centre, and reports help link cases. If money was lost, also report to your local police and keep the file number.

Then tell staff (or family) what happened in plain terms. Real Microsoft, bank and government staff don't cold-call to fix your computer, and your IT provider will never mind you hanging up and calling them back at the number you already have.