What to do after a remote access crypto scam
Disconnect your device from the internet immediately, alert your bank, and run a full security sweep before changing credentials. Remote access scammers manipulate screen-sharing tools to take control of your accounts and transfer funds out directly.
- Remote access fraud occurs when an individual claiming to be a broker or technical support operative convinces you to install screen-sharing software, allowing them to manipulate your screen and financial accounts directly.
- Key warning signs include persistent demands to download desktop-sharing tools, instructions to log into banking or exchange profiles while an operative watches, and sudden unexpected cursor movements or darkened displays during calls.
- Disconnect the affected computer or phone from the internet immediately, uninstall the remote software, and contact your bank and crypto platform using a separate, secure device to freeze all associated accounts and transactions.
- Preserve the remote software connection logs, installation files, communication records across messaging platforms, telephone numbers used by the callers, and transaction receipts showing wallet addresses and timestamps of any unauthorised movements.
- File an official report with Action Fraud to secure a crime reference number, inform your bank's dedicated fraud team, and notify the compliance departments of any exchange platforms involved in the unauthorised transfers.
- An onchain trace can map the exact movement of stolen assets across digital ledgers and identify destination deposits, but it cannot override transactions, recover funds automatically, or reveal the physical identity behind unhosted wallets.
Read next
Written by the Wallsec investigations team. General information only, not legal or financial advice.
Need a case reviewed?
Tell us what happened and we will say honestly whether the onchain data supports a trace.