The ScreenConnect Scam
How Criminals Use Remote Access to Rob You
ScreenConnect is legitimate IT software — but scammers have turned it into one of their most powerful weapons. Once you install it, they can see everything on your screen, transfer your money, steal your passwords, and come back later without you knowing. This guide explains exactly how the scam works and what to do if it happens to you.
What Is ScreenConnect?
ScreenConnect (made by ConnectWise) is a professional remote support tool used by IT companies worldwide — including Next Gen Tech. Thousands of legitimate businesses use it every day. The danger is entirely in who is on the other end of the connection.
Legitimate Use
- Your IT company uses it to remotely diagnose your computer after you called them
- You can always see that a session is active and end it at any time
- The technician only does what you ask — fixes the specific problem you called about
- Reputable companies use it with your documented consent
- Next Gen Tech uses ScreenConnect when clients call us for remote support
How Scammers Abuse It
- They trick you into installing it through fear, urgency, or impersonation
- They connect to a criminal-controlled server — not a real company's
- Antivirus does not flag it — it's legitimate software being misused
- They can enable "unattended access" and return to your computer later — even while you sleep
- Within minutes they can empty bank accounts, steal passwords, and install hidden malware
The Golden Rule of Remote Access Software
If you did not call them first, and they are asking you to install remote access software — it is a scam. Microsoft, Apple, your bank, the Social Security Administration, and the IRS will never call you out of the blue and ask you to install software on your computer.
10 Ways Scammers Get You to Install ScreenConnect
Every one of these approaches uses fear, urgency, or authority to get you to act before you think. Recognizing the pattern is your best defense.
Cold-Call "Tech Support"
You receive an unsolicited call from someone claiming to be from "Microsoft Support," "Windows Technical Department," or a generic "Computer Security Center." They claim your computer is infected and ask you to go to a website and download ScreenConnect so they can "fix" it. This is one of the most common vectors — it targets seniors especially.
Very CommonFake Browser Pop-Up Alerts
A malicious website or ad triggers a full-screen pop-up mimicking a Windows or Mac error. It shows alarming messages like "YOUR COMPUTER HAS BEEN LOCKED" or "VIRUS DETECTED — CALL MICROSOFT IMMEDIATELY" and may freeze your browser. When you call the number shown, the scammer walks you through downloading ScreenConnect.
Very CommonFake Social Security Administration Emails (Active 2025)
Emails with subject lines like "Your Social Security Statement is now available" contain links that download a ScreenConnect installer disguised as a PDF. Cybersecurity firm Malwarebytes identified this as a major active campaign in April 2025, originating from a criminal group called "Molatori" using hacked legitimate websites to send emails that bypass spam filters.
Active CampaignFake Refund / Overpayment Scam
You receive a call claiming you are owed a refund from Norton, Amazon, Microsoft, or your utility company. The scammer asks to install ScreenConnect to "process the refund." Once connected, they manipulate what you see on screen — making it appear a large amount (e.g., $5,000 instead of $50) was deposited — then pressure you to "return" the overpayment via gift cards or wire transfer. No real money ever arrives — it is all screen manipulation.
Growing FastFake Bank Fraud Alert
Someone calls claiming to be your bank's fraud department, saying your account has been compromised. They ask you to grant remote access to "verify" or "protect" your account. Real banks never ask for remote computer access — if you are worried about your account, hang up and call the number on the back of your card.
CommonFake IT Helpdesk / Invoice Emails
Phishing emails impersonate your company's IT department or major vendors, instructing you to "update remote support software" or respond to a "security incident." In May 2025, security researchers found signed malicious ScreenConnect installers disguised as invoices targeting global financial organizations.
Targets BusinessesFake Zoom / Teams Meeting Invites
Phishing emails impersonate Zoom, Microsoft Teams, or similar platforms with fake meeting invites — often with subject lines like "Meeting Invite – 2024 Tax Organizer." Clicking the link leads to a page that prompts download of a ScreenConnect installer instead of real meeting software.
CommonTrojanized Software Downloads
Criminals create fake download pages for popular free programs (AntiMicroX, Bandicam, CPU-Z, and others). You search online, click what looks like the real site, and download what secretly bundles a ScreenConnect installer. Since early 2025, security firm Acronis has documented a surge of these attacks targeting U.S. residents.
Surging in 2025Fake Job Postings / HR Onboarding
Fake job listings or "onboarding" emails instruct new employees to install remote support software including ScreenConnect as part of a fraudulent setup process — giving scammers access to your personal device and any accounts you log into during the process.
EmergingFake E-Invites & Event Links
You receive what looks like a digital invitation to a party, wedding, reunion, or community event — sent through platforms like Evite, Paperless Post, or a plain email. The "RSVP" or "View Invite" button leads to a page that prompts you to download ScreenConnect, claiming it is needed to "confirm your attendance," "access the event details," or "download the event program." These are especially effective because they feel personal and low-risk — you are not expecting a scam in a party invitation. The link may also arrive through Facebook events, text messages, or shared Google Calendar invites.
GrowingWhat a Scammer Can Do Once They're In
ScreenConnect gives them the same level of access as sitting at your keyboard. This is not hypothetical — these are documented actions used in real attacks.
💳 Financial Theft
- Transfer money directly from your bank, brokerage, or PayPal account
- View your full account numbers, routing numbers, and saved payment methods
- Set up new payees and wire funds to criminal-controlled accounts
- Apply for credit cards or loans in your name
- Access your tax preparation software and steal your refund
- Manipulate what you see on screen while draining your account in another window
🔑 Credential & Identity Theft
- Open your browser's saved password manager and copy every password
- Install a keylogger to capture every future password you type — even after the session ends
- Access your email to reset passwords on financial accounts and lock you out
- Steal Social Security numbers, tax returns, and IDs from your Documents folder
- Capture two-factor authentication codes if your phone is linked to accounts they can see
🦠 Malware & Ransomware
- Install ransomware that encrypts all your files and demands payment
- Drop Remote Access Trojans (RATs) that give them covert access even after you uninstall ScreenConnect
- Plant crypto mining software that slows your computer and runs up electricity costs
- Create new administrator accounts so they can return even if you change your password
- Disable Windows Defender and your firewall to make future attacks easier
👁️ Surveillance & Persistence
- Watch everything you do in real time — every website, every document you open
- Enable "unattended access" and return while you sleep — days or weeks later
- Exfiltrate (copy out) your personal files to their servers without you noticing
- Use your computer and email address to scam your family and friends
- File fraudulent tax returns or apply for government benefits using your stolen information
Red Flags at Every Stage
Before You Install — Stop If You Notice These
During a Session — Hang Up Immediately
After a Session — Investigate These Signs
If You Installed ScreenConnect for a Scammer
Every minute matters. Follow these steps in order — speed is essential, especially if any financial accounts were visible during the session.
Disconnect the Internet — Right Now
Unplug the Ethernet cable from your computer, or turn off Wi-Fi. This severs the scammer's active connection immediately. Do this before anything else — while they are connected, they can still act.
Hang Up and Do Not Call Back
End the call immediately. Do not call the number back. Do not follow their instructions on how to "undo" anything — they will try to maintain access or extract more from you.
Call Your Bank From a Different Device
Use a different phone or device (not the compromised computer). Call the fraud department using the number on the back of your card or a printed statement — not a number the scammer provided. Tell them your computer was accessed by a scammer. Ask them to review recent transactions, freeze the account, and change your online banking credentials.
Change Passwords on a Clean Device
From a different, unaffected device (phone, tablet, or another computer), change passwords for: your email accounts first (Gmail, Outlook — they control everything else), then online banking, social media, and your Microsoft or Apple account. Do not do this on the compromised computer.
Enable Two-Factor Authentication (2FA)
Turn on 2FA for your email and banking accounts. This means even if a scammer has your password, they cannot log in without a code sent to your phone. Your bank, Gmail, and Outlook all offer this for free.
Remove ScreenConnect
Go to Control Panel > Programs > Uninstall a program. Look for "ScreenConnect Client" or "ConnectWise Control Client" and uninstall it. See the removal section below for instructions if it does not appear in the list.
Run a Full Security Scan
Use Windows Defender (built into Windows — search "Windows Security" in the Start menu) to run a Full Scan. Also download and run the free version of Malwarebytes for a second opinion. Note: this will find most — but not necessarily all — malware that was installed.
Freeze Your Credit
Contact all three credit bureaus and place a security freeze — this is free by law and prevents scammers from opening new credit in your name. Equifax: 1-800-349-9960 | Experian: 1-888-397-3742 | TransUnion: 1-888-909-8872. You can also do it online at each bureau's website.
Report the Scam
Reporting helps law enforcement find and stop these criminal operations. See the reporting section below for exact links and numbers. Do not be embarrassed — these are sophisticated organized crime operations and anyone can be deceived.
Not Sure If Your Computer Is Still Compromised?
If you are not confident all malware has been removed, the safest option is a professional clean reinstall. Next Gen Tech offers exactly this service for the Smith Mountain Lake area.
Call (540) 719-0700How to Remove ScreenConnect
Remember: removing ScreenConnect does not remove other malware the scammer may have installed during the session. A full security scan is still required.
💻 Windows — Standard Method
- Disconnect from the internet first (see Step 1 above)
- Click the Windows Start button and search for "Control Panel"
- Click Programs → Uninstall a program
- Find "ScreenConnect Client" or "ConnectWise Control Client" in the list
- Click it and select Uninstall
- Restart your computer when complete
🔎 Windows — If It's Not in the List
- Press Windows key + R, type
services.msc, press Enter - Scroll for any service with "ScreenConnect" in the name
- Right-click it → Stop, then Properties → set Startup type to Disabled
- Open Command Prompt as Administrator and run:
sc delete "ScreenConnect Client"
🚨 If the Scammer Controls Your Mouse
- Press Ctrl + Alt + Delete — this cannot be overridden by ScreenConnect
- Select Task Manager
- Find any process named "ScreenConnect" or "ConnectWise" and click End Task
- If you cannot use the keyboard, hold the power button for 5 seconds to force-shut down
- Do not turn the computer back on until you have disconnected it from the internet
🍎 Mac Users
- Open the Applications folder and drag any ScreenConnect application to the Trash
- Go to System Settings > Privacy & Security > Accessibility and remove ScreenConnect permissions
- Empty the Trash and restart your Mac
- Run a full scan with Malwarebytes for Mac (free version available)
- Check System Settings > Users & Groups for any accounts you did not create
Report It — Every Report Helps
These are organized international criminal operations. Reporting them — even if you lost no money — helps federal and state law enforcement track patterns, issue warnings, and make arrests. You are not alone and there is nothing to be embarrassed about.
In 2024, the FBI made 215+ arrests at scam call centers in international joint operations — your report contributes to investigations like those.
Federal Trade Commission
File a fraud report with the FTC and receive a personalized recovery plan at ReportFraud.ftc.gov
reportfraud.ftc.gov →FBI Internet Crime Center
The FBI's IC3 handles cybercrime reports and coordinates with international law enforcement.
ic3.gov →Virginia Attorney General
Virginia residents can file a consumer complaint directly with the Virginia AG's Consumer Protection Section.
ag.virginia.gov →Report to ConnectWise
ConnectWise actively investigates and shuts down criminal ScreenConnect servers. Report the malicious session directly.
connectwise.com/trust →