A retired couple in Prestonpans brought us a laptop on a Thursday morning in an obvious state of worry. The husband had taken a call the day before from someone claiming to be a Microsoft engineer, who said their home PC was “sending out viruses to the whole BT network” and offered to prove it. He had been talked through installing AnyDesk, read out the nine-digit session code, and watched for about twenty minutes while the cursor moved around a Command Prompt showing “errors” that were actually normal Windows output. The call ended when he started asking questions, and the moment the screen went dark again neither of them knew whether their bank account or their photos had just walked out the door.
Remote-access scams like that are the most common cybersecurity job we see in Prestonpans, Cockenzie and across East Lothian from Tranent to Musselburgh, because the attacker never needs a victim’s password — they ask the victim to let them in through the front door, and most of the work on the bench afterwards is figuring out what they touched on the way through. The order below is the one we actually use.
The First Hour, Before You Phone Anyone
The moment a call like that ends, two things need to happen quickly, in this order: get the PC off the internet, then stop using it. Yank the Ethernet cable if there is one, toggle Wi-Fi off from the physical switch or the Windows taskbar, and if the laptop has a hardware flight-mode switch flick that too. Powering the PC off completely is not necessary and in a few cases makes the bench job harder — the memory holds evidence of what was running — but if the attacker is still live on the machine when the call ends, closing the lid and pulling the power cable is better than letting another command land.
After that, the second job is the one people forget: write down what you saw. The caller’s accent, the name they gave, what they said was wrong, what application they asked you to install, what websites they opened, whether they asked you to type a code or read numbers off a card, and at roughly what time. Memories blur within an hour of an upsetting call, and the sheet of paper that one of our Prestonpans customers handed us with “AnyDesk, said he was from Microsoft, nine-digit code, opened Edge and typed something about firewalls” saved us about an hour of investigation on the bench.
How These Scams Work and What the Attacker Usually Does
Behind the dramatic patter the mechanics are mundane. The attacker’s goal in the first few minutes is to install a tool that lets them come back without the victim on the phone, and to find anything that can be turned into cash before the victim notices. The tool is usually a legitimate remote-access product used dishonestly — AnyDesk and TeamViewer first, but we also see Supremo, UltraViewer, ScreenConnect, Splashtop, and more recently Microsoft’s own Quick Assist, which makes an inviting pitch because it is already on Windows 11 and does not need an install. A layer underneath that, they will sometimes drop a RAT (a remote-access trojan) that survives after the official tool is uninstalled, so uninstalling AnyDesk alone is not the end of the story.
The cash side is where it gets ugly. On a home PC the attacker will open the browser, look at saved logins for banks and PayPal, try the bank app if one is pinned, and in a lot of cases open a “bank refund” chat with the victim present and type a larger number than they offered to send, then pretend it is an accident so the victim will “return the difference” from their own money. On a small-business PC the same session may end with a hidden Outlook rule forwarding anything with the word “invoice” to an external address, which is the start of a different, slower problem. We check both, not one.
The Remote-Access Tools We Look For First
On the bench, the first sweep after a scam call is a methodical check of every remote-access tool the market offers. Installed programs in Settings and in Program Files catch AnyDesk, TeamViewer, Supremo, UltraViewer, LogMeIn, ScreenConnect, Splashtop, ShowMyPC, Zoho Assist and the like. Scheduled Tasks and Windows Services catch the ones that were set to auto-start. The Quick Assist history and the Remote Desktop settings get checked, because both are built into Windows and do not show up in the installed-programs list. If AnyDesk was used, its log files record the unattended-access password, the incoming ID and the file-transfer activity — we read those rather than just uninstalling, because they tell us what actually happened.
The tools get removed cleanly, not just uninstalled through the Start menu, because several leave behind a service and a registry run-key that a rushed uninstall skips. We also check the local user accounts list and the hidden administrator state; on one PC last year the attacker had added a second local account with administrator rights so they could sign back in over Remote Desktop even if everything else was cleaned up. That is the quiet part of this work — a clean desktop does not mean a clean PC. For a thorough job, our virus and malware removal service runs offline scans from a trusted boot environment as well, so anything that has hooked into the running Windows session cannot hide from the scanner.
Passwords, Browsers and Saved Logins — What’s Already Leaked
The assumption on the bench after a remote-access session is that everything the browser remembered has been seen. Chrome, Edge and Firefox all offer a “view saved passwords” screen that requires only the Windows account password, which the attacker often watched the victim type. The practical response is to change every password that is important, from a different device — a phone on mobile data is ideal — starting with the email that other accounts send reset links to, then the bank, then anything with a saved card. Turning on two-factor authentication on the email and the bank at the same time closes the most-used reset routes, and that step alone is often the one thing that stops a quiet follow-up weeks later.
We also look at Outlook, Thunderbird and the webmail session in the browser for new forwarding rules, new signatures, new filters, and recent sent items the owner did not send. If the attacker had five minutes in the inbox, a forwarding rule pointing anything with “invoice”, “payment” or “bank” to a Gmail address they control is a common trick. A customer in Cockenzie last summer only discovered the rule six weeks after the original call, when a supplier chased an invoice that had been quietly paid to the wrong bank account. We now check that in every scam-recovery job, which is also the kind of check that turns into a separate conversation under our business IT support service for the small East Lothian businesses that find themselves on the wrong end of one. If you have already followed a link from the same session, our guide on what to do after clicking a suspicious link covers the parallel browser-side steps.
Bank and Payment Checks
Nothing we do on the PC replaces talking to the bank, and the sooner the better. The industry number to remember is 159 — a shortcut that connects you straight to your own bank’s fraud team without having to find the number on the back of a card the attacker may have watched you pick up. If any money has moved, or you have been asked to move any money as part of the call, that is the first call to make, from a different phone if possible. Keep screenshots or photos of any chat windows, bank “refund” pages, or support tickets the attacker opened in the browser, because the bank’s fraud team will often ask for them. The scam itself can be reported to Police Scotland on 101 and to Action Fraud at actionfraud.police.uk, and the crime reference number is sometimes useful for the bank’s own investigation. Similar remote-execution tricks are covered in our earlier write-up of a fake CAPTCHA that installs malware — the mechanics are different but the clean-up checklist overlaps.
When a Clean Reinstall Is the Only Safe Option
For a short call where the attacker barely got past opening AnyDesk, a careful sweep is usually enough. For a longer session — thirty minutes or more, a Command Prompt that was actually used, a bank login seen on screen, or a second local account added — we usually recommend a clean Windows reinstall rather than trying to prove a PC is clean. The honest truth about modern malware is that a determined attacker with administrator rights for half an hour can hide code in places an antivirus scanner will not look, and the only guaranteed clean machine is a fresh install on a reformatted drive. That part sits under our OS installation service, and the files, bookmarks and email archives worth keeping come off the drive before the reinstall under our data recovery workflow so nothing is lost in the clean sweep.
If the PC held anything that could be a target for ransomware or extortion follow-ups, we also pull a full image of the drive before the reinstall and keep it for a few weeks on isolated storage, so there is a forensic copy to go back to if the picture changes. It is the same discipline we use on our priority Leith virus removal jobs, where the customer base is larger and the follow-up risk is higher, and it costs nothing to apply it to a Prestonpans home PC as well.
Setting the PC Up So the Same Call Can’t Succeed Again
After the reinstall or the clean-up the last step is the useful one. The daily-driver Windows account is switched to a Standard account, not an administrator, so a future caller’s installer prompt fails without a password that the owner does not have. Two-factor authentication goes on the main email, the bank and the Microsoft or Google account. A password manager replaces the browser’s saved-passwords feature, which keeps new logins out of the one place an attacker always looks. Any remote-access tool that is not needed is removed, and if one is needed we configure it with a strong unattended-access password and an allow-list of IDs rather than letting it accept any incoming session. If the owner was already paying for a reputable antivirus product, we leave it in place and tune it; if they were not, we leave Windows Defender configured properly, which on a modern PC is already better than most of the paid alternatives at stopping this kind of social attack. If you think the attacker also had a look at your webmail, our write-up on what to do when your email has been hacked covers the forwarding-rule and recovery-contact sweep in detail.
Remote-access scam calls land every week in Prestonpans, Cockenzie, Tranent and Musselburgh, and most of the time the right response is a calm hour of checks rather than a panic. If a call like the one above has just happened to you or someone in the family, bring the PC to the EH11 workshop or book a collection across East Lothian. Our Prestonpans virus removal page covers the collection detail for the Prestonpans and Cockenzie postcodes, and the end-to-end recovery — remote-tool sweep, hidden-account check, password and browser reset, email-rule review, Windows rebuild where needed and bank-side guidance — sits under our virus and malware removal service, with same-day remote support available if getting the PC in person is not easy.
Last updated: 5 November 2026