What to do after a remote access crypto scam
If a fraudster accessed your computer to trade or buy cryptocurrency, immediately disconnect the device from the internet, secure your banking and exchange accounts from another machine, and inform your bank and the police.
- This fraud usually begins when an individual offering trading assistance or technical help instructs you to install software that allows them to view and control your computer or phone screen.
- Prompts to log into online banking, transfers conducted while your screen is blacked out, and aggressive pressure to approve authentication requests are critical indicators that your system is being compromised.
- Disconnect your device from the internet immediately by unplugging the network cable or turning off Wi-Fi, then change all passwords using a separate, uncompromised device to prevent further unauthorised transactions.
- Preserve logs from the remote software, browser histories, chat transcripts, payment confirmations, and the destination wallet addresses provided by the individual, ensuring you export this material without reconnecting the affected machine.
- Report the incident to Action Fraud, notify your bank's fraud department if fiat payments were made, and alert the compliance team of any cryptocurrency exchange involved in the transfers.
- An onchain forensic analysis can map the outward movement of your funds and identify whether they reached regulated services, but it cannot reveal the real-world identity of the person controlling intermediate addresses.
Read next
Written by the Wallsec investigations team. General information only, not legal or financial advice.
Need a case reviewed?
Tell us what happened and we will say honestly whether the onchain data supports a trace.