The Support Agent Asked Me to Install Remote Access Software: How to Investigate Remote Access Scams and Device Compromise
A message from customer support says there is a problem with your account. A representative offers to help, but first asks you to install remote-access software so they can inspect your computer or phone.
The request may sound reasonable. The person might know your name, the company you use, details about a recent transaction or even the last few digits of an account number. They may speak confidently, use professional language and guide you through what appears to be a routine support process.
Then they ask you to share a connection code, approve a screen-sharing session or give them control of your device.
This is where a routine support interaction can become a serious security risk.
Remote-access software has legitimate uses. Businesses use it for technical support, system administration and collaboration. However, scammers can exploit the same technology to view private information, manipulate online accounts, initiate transactions or install additional software.
If someone you do not trust has connected to your device, simply uninstalling the remote-access application may not be enough. You may need to establish what happened, which accounts were exposed, whether additional software was installed and what evidence remains.
This guide explains how remote-access scams operate, what to preserve and how a suspected device compromise can be investigated.
1. Understand How Remote-Access Scams Begin
Remote-access scams often begin with an unsolicited or unexpected interaction.
The contact may arrive through a telephone call, email, text message, social media account or messaging application. The person may pretend to represent a bank, cryptocurrency exchange, investment platform, software company or technical support department.
Common explanations include:
- Your account has been compromised.
- A suspicious transaction needs to be reversed.
- Your computer has a security problem.
- Your cryptocurrency wallet needs verification.
- A payment is pending and requires technical assistance.
- Your investment account needs to be synchronised.
- A withdrawal cannot be processed until a problem is fixed.
The caller or representative then recommends installing a remote-access tool.
The software itself may be a legitimate product. The risk comes from who is requesting access, why they want it and what they do after the connection is established.
Preserve the original contact and any instructions before deleting messages or blocking accounts. These records may help establish how the interaction began.
2. Identify the Remote-Access Software Used
The first investigative step is to identify exactly which software was installed or used.
Remote-access and screen-sharing products have different capabilities. Some allow a person to view a screen, while others can provide keyboard and mouse control, transfer files or maintain unattended access.
Record:
- The software’s full name.
- The publisher or developer.
- The version installed.
- The download source.
- The installation date and approximate time.
- The connection or session code, if retained.
- The name or identifier displayed for the remote operator.
- Whether unattended access was enabled.
- Whether file transfer or other features were used.
Do not assume that every remote-access application is malicious. The investigation should distinguish between legitimate software used in an unauthorised way and software that may itself be harmful.
If you are unsure which application was installed, check the device’s application list, installation history and available security records.
3. Preserve the Messages and Instructions
The conversation that led to the remote connection may be just as important as the software itself.
Preserve the original messages, emails, call records and support instructions. Avoid relying only on handwritten notes or recollections.
Useful records may include:
- Email headers and original email files.
- Messaging conversation exports, where available.
- Screenshots of instructions.
- Telephone call logs.
- Usernames and profile links.
- Phone numbers and email addresses.
- Website URLs supplied by the representative.
- Remote-access session details.
- Payment instructions and transaction confirmations.
Record the dates and times as accurately as possible, including the time zone where known.
If the person claimed to represent a real company, independently verify that claim using the company’s official contact details. Do not continue communicating through contact information supplied exclusively by the suspected representative.
For incidents involving suspicious email communications, Cyb3rsect’s Email Forensics resources provide further context on examining email evidence.
4. Determine What Level of Access Was Granted
Not every remote-access session gives the other person the same level of control.
Some sessions are limited to viewing a screen. Others allow remote keyboard and mouse input, file transfers or more extensive interaction with the device.
Establish what permissions were granted.
Questions to investigate include:
- Was the session view-only or full control?
- Could the remote operator move the mouse or type?
- Was file transfer available?
- Were files opened, copied or downloaded?
- Did the user approve administrator permissions?
- Was unattended access configured?
- Was the session connected more than once?
- Did the operator ask the user to open banking or cryptocurrency accounts?
A person may have been able to see sensitive information even if no files were visibly downloaded.
For example, a remote operator who can view a screen may see account balances, private messages, identity documents or authentication prompts.
The investigation should document what access was technically available and what activity can actually be established. Do not assume that every capability was used merely because the software supported it.
5. Examine Whether Additional Software Was Installed
Remote-access scams can involve more than one application.
A representative may ask the user to install a second program described as a security update, verification tool, wallet synchronisation utility or account protection service.
Review the device for unfamiliar applications and recent changes.
Potential evidence includes:
- Newly installed applications.
- Browser extensions.
- Unfamiliar startup items.
- Unexpected configuration changes.
- New user accounts.
- Unrecognised remote-access utilities.
- Security alerts.
- Unusual scheduled tasks or background processes.
On a Windows computer, relevant information may be available through installed application records, Windows security logs, endpoint protection history and other system artefacts.
On a mobile device, the available evidence depends on the operating system, device configuration and application permissions.
Do not remove suspicious files or applications before considering whether they may be relevant evidence. If the device appears to remain compromised, prioritise containment and seek qualified technical assistance.
6. Investigate Browser and Account Activity
A remote operator may use an active browser session to interact with websites already logged in on the device.
This can create risks even if the operator never learns the user’s password.
Review relevant account activity for:
- Unrecognised login sessions.
- New devices or browser sessions.
- Password-reset requests.
- Changes to recovery email addresses or phone numbers.
- New authentication methods.
- Unexpected forwarding rules.
- New connected applications.
- Unfamiliar account permissions.
- Unusual financial activity.
Pay particular attention to email accounts. Access to an email account can sometimes allow someone to reset passwords for other services.
Where available, preserve security notifications and account session records before signing out or changing settings.
If an account appears compromised, secure it from a trusted device. Change affected passwords, revoke unknown sessions and review recovery options. Use multifactor authentication where available.
7. Check for Unauthorised Financial Activity
If the remote operator had access to a device used for banking, payments or cryptocurrency, investigate those accounts separately.
Look for transactions or account changes that occurred during or shortly after the remote session.
Relevant evidence may include:
- Bank transfer confirmations.
- Payment recipient details.
- Cryptocurrency transaction hashes.
- Wallet addresses.
- Exchange withdrawal records.
- New payment beneficiaries.
- Changes to withdrawal settings.
- Unfamiliar wallet connections.
- Account security notifications.
Create a timeline connecting the remote-access session with any financial activity.
A transaction occurring after a remote session does not automatically prove that the remote operator initiated it. Other explanations may exist. However, the timing may provide an important investigative lead.
Contact the relevant bank, exchange or payment provider promptly if unauthorised activity is suspected. Use official channels and ask what protective or reporting steps are available.
8. Examine Cryptocurrency Wallet Exposure
Remote-access scams can be particularly concerning when cryptocurrency wallets are involved.
A remote operator may ask a user to open a wallet, visit an exchange, display a recovery phrase or approve a transaction.
Never share a wallet’s recovery phrase or private key with a support representative. A legitimate support process should not require someone else to obtain unrestricted control of a user’s wallet.
If a wallet may have been exposed, preserve:
- Wallet addresses.
- Transaction hashes.
- Network details.
- Transaction dates and times.
- Screenshots of wallet activity.
- Exchange withdrawal confirmations.
- Messages containing payment instructions.
- Records of any transaction approvals.
Blockchain analysis may help establish the movement of funds between publicly visible addresses. However, a wallet address does not automatically reveal the identity of the person controlling it.
For more information about preserving evidence in financial and cryptocurrency incidents, see Cyb3rsect’s digital evidence preservation guide.
9. Preserve Device Evidence Before Making Major Changes
One of the most common mistakes after a suspected remote-access incident is immediately wiping or resetting the device.
A factory reset may remove useful records. Uninstalling applications or clearing browser data may also make it harder to reconstruct what happened.
Where it is safe to do so, preserve relevant information before making major changes.
Depending on the device and circumstances, useful evidence may include:
- Installed application records.
- Remote-access session logs.
- Operating system security logs.
- Browser history.
- Download records.
- Application configuration.
- File modification timestamps.
- Security alerts.
- Account activity notifications.
- Relevant network records.
If the device is actively being controlled or appears to be transmitting information without authorisation, containment takes priority. Disconnecting it from the network may be appropriate, but the decision should consider the need to preserve volatile evidence.
For a significant incident, a qualified digital forensic professional can advise on appropriate acquisition and preservation methods.
The aim is to maintain the integrity of the available evidence and document any actions taken.
10. Build a Timeline of the Incident
A clear timeline helps connect the initial contact, installation, remote session and any subsequent account or financial activity.
| Event | Evidence to preserve |
|---|---|
| First contact | Call log, email or message |
| Support claim made | Original instructions and sender details |
| Software downloaded | Download source and file details |
| Software installed | Installation records and version |
| Remote session started | Session records and approximate time |
| Access granted | Permission prompts and session details |
| Account accessed | Login alerts and account activity |
| Financial activity occurred | Bank or blockchain records |
| Suspicious activity discovered | Notifications, screenshots and reports |
| Security steps taken | Password changes, session revocations and support tickets |
Use exact timestamps when available. If the time is approximate, label it as approximate rather than presenting it as certain.
This chronology can help identify gaps, inconsistencies and events that require further examination.
11. What to Do After a Remote-Access Scam
If you believe someone has gained unauthorised access to your device, act carefully and promptly.
- End any active remote-access session.
- Disconnect the affected device from the internet if ongoing access is suspected and it is safe to do so.
- Contact your bank or financial provider if payment activity may be affected.
- Use a trusted device to change passwords for exposed accounts.
- Revoke unfamiliar sessions and connected applications.
- Review email forwarding rules and account recovery settings.
- Enable multifactor authentication where possible.
- Preserve messages, session details and financial records.
- Arrange a security assessment if the device may remain compromised.
- Report suspected fraud through the appropriate official channels.
Do not rely on the person who initiated the remote session to help secure the device.
Be particularly cautious if someone contacts you afterwards claiming they can recover money or remove the compromise for an upfront payment. Follow-up recovery scams can target people who have already experienced financial fraud. Read Cyb3rsect’s guide to fake crypto recovery companies for additional warning signs.
How Cyb3rsect Can Help Investigate Remote-Access Incidents
A remote-access incident can leave evidence across several different systems.
The initial contact may be recorded in email or messaging applications. The remote-access software may contain session information. The device may retain installation or security records, while financial accounts may show activity that occurred during the same period.
Cyb3rsect focuses on digital forensics, cyber investigations and online fraud intelligence.
Depending on the available evidence and agreed investigation scope, work may include:
- Reviewing remote-access software and session information.
- Examining suspicious communications and support instructions.
- Reviewing available device and account records.
- Identifying potentially unauthorised software or configuration changes.
- Examining relevant browser and email activity.
- Reviewing cryptocurrency transaction information.
- Building a chronological record of events.
- Identifying technical inconsistencies and investigative leads.
- Preparing a structured report that distinguishes findings from unresolved questions.
An investigation cannot guarantee that every action performed during a remote session will be recoverable. Available evidence depends on the device, software, retention settings and steps taken after the incident.
A careful examination can nevertheless help establish what records remain, what activity can be verified and what further steps may be appropriate.
Final Thoughts
Remote-access software is not inherently malicious. The danger arises when an unknown or unverified person persuades someone to grant access under false pretences.
If a supposed support agent asks to control your device, verify the request independently. Do not share passwords, authentication codes, wallet recovery phrases or private keys.
If access has already been granted, avoid rushing to erase the device. Secure affected accounts, preserve relevant records and establish a timeline of what happened.
The central question is not simply which remote-access application was installed. It is who requested the connection, what access was granted, what activity followed and what evidence can support the findings.
For guidance on digital forensics and cyber investigations, visit Cyb3rsect.
