The right response depends on whether you clicked, paid, shared a password, installed remote software, or gave someone control of the computer.
What this usually means
Build the response around what the scammer actually obtained. Money or card details require direct contact with the financial provider; a password requires a change from a trusted device plus a review of recovery methods and active sessions; installed remote software requires containment and inspection. Preserve the timeline before cleanup so important details are not lost.
Practical checks and decisions
End contact and write down exactly what happened
For “end contact and write down exactly what happened,” end the contact and do not use the warning’s phone number, link, or download. Preserve the message, number, software name, receipts, and sequence of events before closing or cleaning anything.
Call banks and payment providers through verified numbers
Use “call banks and payment providers through verified numbers” to determine what the stranger actually obtained: screen access, files, passwords, payment details, or money. Contact banks and account providers through independently verified channels from a trusted device.
Change exposed passwords from a trusted device
Before completing “change exposed passwords from a trusted device,” confirm that you control the recovery email, phone, and authenticator. Save backup codes somewhere separate from the computer and never give a caller, pop-up, or remote technician a one-time verification code.
Arrange computer and account review without shame or delay
After “arrange computer and account review without shame or delay,” watch for new login alerts, password-reset messages, sent mail, and changed account rules. Those clues help determine whether the concern ended with one login or requires a wider account review for what to do if you think you were scammed.
When a professional diagnosis makes sense
For what to do if you think you were scammed, get help when money, passwords, email, remote access, or unfamiliar account activity may be involved. Preserve a timeline, avoid further contact with the suspected scammer, and make account changes from a trusted device.
For hands-on or remote help, review the related service, or browse the Help Center for another guide.
