24 October 2026

What to do after remote access crypto fraud

If a fraudster accessed your computer to purchase cryptocurrency, disconnect the machine from the internet immediately, alert your bank, and change passwords from another device. Reporting the crime and tracing the outward transactions can identify where the funds were transferred.

• Remote access cryptocurrency fraud happens when a caller persuades you to install remote desktop software such as AnyDesk or TeamViewer, allowing them to take control of your computer, set up accounts, and transfer your funds into digital assets.
• Key warning signs include callers insisting that you cannot complete transactions alone, aggressive demands to keep your screen shared during banking logins, and unexplained software applications appearing on your desktop without your knowledge or consent.
• Immediately disconnect your computer from the internet, uninstall any remote access applications, change all banking and email passwords from a different, secure device, and notify your bank to freeze your accounts and stop further unauthorised outward payments.
• Preserve connection logs from the remote software, browser histories, phone call records, incoming messages, and exact transaction hashes showing where the cryptocurrency was sent from your accounts, as these records provide crucial information for investigators.
• Report the incident promptly to Action Fraud to receive a police crime reference number, and alert the compliance teams of any exchanges used so they can attempt to restrict the destination accounts before the funds are withdrawn.
• An onchain trace can map where your funds moved across public ledgers and identify destination deposits at commercial services, but it cannot reveal the personal identity of the perpetrator or force the return of stolen digital currency.

Written by the Wallsec investigations team. General information only, not legal or financial advice.