Nobody thinks they will fall for a scam. Then an email arrives that sounds exactly like someone you know, about something you were actually expecting, and you click before you think.
Over the past three months, about 40 customers brought us computers with the same story: "I think I got hacked." They were not careless. They were busy people, on an ordinary day, who clicked one thing.
Most often, the person is talked into installing a real remote-control program, the kind IT companies use to help customers (ScreenConnect and AnyDesk are two). Then a stranger can see the screen, move the mouse, and quietly watch the owner log in to their bank.
Because the program is legitimate, antivirus often stays quiet. Antivirus is a seatbelt, not a force field.
Warning signs to be aware of:
If you notice any of these, start with the steps below.
Scam emails used to give themselves away: bad grammar, odd wording, "Dear Customer." That is over.
Here is what changed. When criminals get into one computer, they can read the owner's email. We have confirmed that attackers used AI to read those emails and write new ones that fit perfectly, because the AI can see exactly how the sender talks to each recipient: the names, the topics, the tone. Then those messages go out to the owner's contacts.
So the next victim gets an email that can look like it came from someone they know and trust, about something real, written the way that person really writes. Nothing in it looks wrong. That is the point. "Does this look suspicious?" is no longer a reliable test, and neither is "it is from someone I know."
A smart, careful customer of ours clicked an invitation that arrived from her grandfather's real email account. We asked her why she would click it. She said, "My grandfather really is making a party." The party was real. But his account had been hacked, and the link in the invitation was fake. That is how these emails work: they wrap a trap around something true.
Ask instead: what is this asking me to do? Click, download, install, log in, or call a number, especially about money? Then check another way first. Call the sender on a number you already have, or type the website address yourself. Never use the link or number in the message.
One rule with no exceptions: no bank, company or Microsoft will contact you out of the blue and ask you to install a program.
1. Stop and disconnect. If you downloaded or ran anything, or someone is on your screen, turn off Wi-Fi or unplug the cable. Do not "just finish" the installer. Do not call any number from a pop-up.
2. Work out what you actually did. Only clicked, then closed the page? Usually low risk. Typed a password or card number? Treat that account as stolen. Installed something, or let anyone control your screen? Treat the whole computer as compromised.
3. Change your passwords from a clean device you trust, like your phone, never the computer you clicked on. Start with your email, because it unlocks everything else, then your bank, then the rest. Passwords typed on an infected computer go straight to the criminal. Turn on two-step verification where you can.
4. Check who else is signed in to your Google account. After changing the password, open your Google devices page (Google Account, Security, Your devices) and sign out anything you do not recognize. Take the locations with a grain of salt. They often show the wrong city, usually where your internet provider is, not where the device really is. Go by the device type and time, and if in doubt, sign it out. You can always sign back in.
5. Call your bank or credit card company right away if you entered payment details, or logged in to your bank while the computer may have been controlled. Use the number on the back of your card. Speed matters more than embarrassment.
6. Warn the people you email. If someone was in your inbox, your contacts are the next targets. A quick message, "do not open anything odd from me this week," can stop the chain.
7. Stop using that computer for banking until someone you trust has checked it.
8. Get it cleaned by someone who can document it. We have had cases where Chase required documentation of the virus from an IT professional before crediting back stolen money and credit card charges. Make sure whoever cleans your computer can document what they found and removed, and ask for that before anything is wiped. We do this with a custom-built tool that records what it finds and removes.
If someone had remote control, a scan cannot tell you what they did inside. We recommend a clean Windows reinstall, with your documents and photos saved first. A recent backup, like the one in our earlier article, makes that easy.
People who have been hacked almost always say, "I am usually so careful." These messages are built to fool careful people. So be slower with anything that asks you to act, and fast if you think you have slipped.
More basics are in The 6 Computer Habits That Prevent Most Problems.
Not sure? Call us before you click, or right after.
Rubin IT is the go-to for English speakers in Israel for computers and tech.
Rubin IT 02-563-6018 | 732-523-5479 | support@rubinit.net | rubinit.net
.svg){kind=icon}