Let a scammer into your computer, or email hacked? What to do now

How these scams usually go

Recognising the pattern helps you know what the scammer may have done, and helps you spot the next attempt.

• The call or pop-up — someone claims your computer, internet or bank account has a problem — often "from" Telstra, NBN, Microsoft, Apple or your bank
• Remote access — they ask you to install a program such as AnyDesk or TeamViewer, or visit a site that gives them control of your screen
• The urgency — they insist it must be fixed now, keep you on the phone, and discourage you from hanging up or asking anyone
• The ask — logging into online banking "to receive a refund", reading out a code sent by SMS, or buying gift cards

Do these first, in this order

Speed matters most for your money, so start there. Then cut the scammer off from the computer.

• Call your bank — use the number on your card or the bank's official website, not one the caller gave you — ask them to freeze or watch your accounts
• Disconnect from the internet — turn off Wi-Fi or unplug the network cable so any remote connection is cut
• Do not answer their calls — scammers often ring back posing as a "fraud team" or the police — hang up
• Change passwords from another device — start with email and banking, using a phone or a computer you trust, not the one they accessed

Clean up the computer — Windows and Mac

Remove the remote-access program and anything else they installed. If you are unsure what they did, it is safest to have the machine checked before you use it for banking again.

If your email has been hacked

An email account is the key to most of your other accounts, because password resets go there. Once you are back in, check for the changes attackers commonly make to keep access.

• Change the password and sign out everywhere — most providers have an option to sign out of all other sessions
• Turn on two-step verification — a code from your phone or an authenticator app stops a stolen password from being enough
• Check forwarding and rules — attackers often add a rule that forwards or deletes your mail so you do not notice
• Check recovery details — make sure the recovery phone number and email are still yours
• Warn your contacts — tell people not to act on recent messages from you asking for money or payment changes

Report it

Reporting helps you and others. In Australia, report scams to Scamwatch (scamwatch.gov.au) and cybercrime, including hacked accounts and losses, through ReportCyber at cyber.gov.au. If your identity documents or details were shared, IDCARE (idcare.org) is a free national identity support service that can walk you through the next steps.

See also: How to remove a virus or malware safely