The victim gets called, gets an email telling them to call some number, or finds a number for support (of some kind) while googling online.

The victim then accepts whatever the support says, which will often involve installing some software like Teamviewer or Logmein or one of many possible programs. (These programs are not malware, but like a hammer can be used to hurt someone, you can use this software for bad purposes also.)

Make sure you have the right phone number. Use normal search terms so you get an obvious website (e.g. look for "toshiba", not "toshiba free repair help me"). Check if the search result you are clicking contain an "ad" label or something. Don't click ads...

Also, tech support will almost never ask you to install software on your computer. Especially for something like your bank, it almost never makes sense, because they are not the owners of your computer and you don't have an existing support contract with them.

If you receive a call or email and they ask you to pay something unexpected or to connect to your computer: look up the real phone number or email address online, ask them whom to ask for, and then call/email the real number/address and just ask for that person. If it's legit, you will be able to call them right back without problems.

1. What they do

This is a bit more dynamic and might change over time. There's a lot of info online about what the common scam methods are, how they work, how you can verify if something is legit. That is not very IT security related, so I will not go into that here.

In terms of software modifications, though it might depend on the type of scam, they mostly just install this remote software and perhaps another tool to maintain some level of access after disconnecting the live session. If you get them angry they might also try to break things (like set a password that you don't know) but this is not really useful for them.

It is extremely unlikely that a support scam has real, new vulnerabilities that they make use of, they mostly just ask nicely if they want access to something. Or they ask un-nicely, but they threaten you with something (withholding money, file encryption, something like that).

2. What you can do to help afterwards

The best thing is: wipe the infected computer. Don't copy any files because those might be infected, but instead restore from a clean backup (if that is available).

In practice, pictures are mostly safe, but there can be trickery to it looks like a picture but really it's a program. Safest is to not copy any files, if that is possible in your situation.

Although they usually don't do much more than install the remote software, there is no way to be sure. You should not assume that you are safe merely after removing their software.

Having network access is not that important, unless you run special software (e.g. XAMPP, file shares, ssh, or other things that are network-accessible). Your network is almost certainly not compromised and other computers on the network are very unlikely to be affected.

In fact, the network itself cannot really be compromised, just things connected to it (including your router, but again, as of 2022 they are almost never this clever).

Check that all systems had the latest software. If the systems were up-to-date during the time of the access, then no known weaknesses are likely to have been abused. Malware scanners might also help here, but not necessarily (careful what else you install).

Any files they had access to: you should consider those compromised or stolen. If you have a password manager, be sure the password is strong and it was never unlocked while they had access, else everything inside is likely already compromised. If you store passwords in a browser, those are almost certainly compromised as well. (To be clear: password managers are good, but don't give attackers access to your system and then enter the master password...)

The victim receives a call, or an email telling them to call some number, or finds a number for support (of some kind) while googling online.

The victim then accepts whatever this support says, which will often involve installing some software like Teamviewer or Logmein or a similar program. (These programs are not malware, but like a hammer can be used to hurt someone, you can use this software for bad purposes also.)

Incoming calls (caller ID) and email addresses ("From") can be spoofed pretty easily. But if you dial a number or send an email, it is much harder to intercept this. That is why calling back to a known-to-be-legitimate number, or email back to a known-to-be-legitimate email address, is what you should do. Just ask for the person's name (if on a call) so that you can ask for this person when calling back. If it is legitimate, this will be absolutely no problem.

When calling, make sure you have the right phone number. Use normal search terms so you get an obvious website (e.g. look for "toshiba", not "toshiba free repair help me"). Check if the search result you are clicking contain an "ad" label or something. Don't click ads...

Tech support will almost never ask you to install software on your computer. Especially for something like your bank, it never makes sense, because they are not the owners of your computer and you don't have an existing support contract with them.

Also, have backups. Anything you want to keep longer than until tomorrow, make sure you have a copy somewhere. Hard drives crash, houses get broken into, people get scammed.

1. What the scammers do

This varies and changes over time. There's a lot of info online about what the common scam methods are and how they work. That is not very IT security related, so I will not go into that here.

In terms of software modifications (although this might depend on the type of scam), they usually just install this remote software and perhaps another tool to maintain some level of access after disconnecting the live session. If you get them angry they might also try to break things (like set a password that you don't know) but this is not really useful for them.

It is extremely unlikely that a support scam has real, new vulnerabilities that they make use of. Usually they just ask nicely if they want access to something. Or they ask un-nicely while threatening with something (withholding money, file encryption, something like that).

2. Fixing it afterwards

The best thing is: wipe the infected computer. Don't keep/copy any files because those might be infected, but instead restore from a clean backup (if that is available).

In practice, things like pictures are fairly safe, but there can be trickery to it looks like a picture but really it's an executable program (malware). It is safest to not keep any files, insofar that is possible in your situation.

Although they usually don't do much more than install the remote software, there is no way to be sure. You should not assume that you are safe merely after removing their software. (In a desperate case, this would be a quick first step to make it usable again, but I would not trust that computer ever again until it had a proper reinstall!)

Having network access is not that important, unless you run special software on other systems in the network (e.g. XAMPP, file shares, ssh, or other things that are network-accessible). Your network is almost certainly not compromised and other computers on the network are very unlikely to be affected.

In fact, the network itself cannot really be compromised, just things connected to it (including your router, but again, as of 2022 they are almost never sophisticated enough to do something like exploit a router).

Check that all systems had the latest software. If the systems were up-to-date during the time of the access, then no known weaknesses are likely to have been abused. Malware scanners might also help here, but not necessarily (careful what you install from random websites).

Any files they had access to: you should consider those compromised. If you have a password manager, be sure the password is strong and it was never unlocked while they had access, else everything inside is likely already compromised. If you store passwords in a browser, those are almost certainly compromised as well. Those password in there will need changing. (To be clear: password managers are good, but don't give attackers access to your system and then enter the master password...)

4. Report to the authorities

It is well known that most police (or other authorities) do not have the knowledge or manpower to pick every individual case up. However, if nobody ever reports anything, there is also no pressure to learn or even try to catch these criminals, or to consolidate evidence on a single scam group.

I would always recommend reporting an (attempted) break-in to the police, no matter if it was digital or physical. Keep track of things like phone numbers and especially bank accounts used by the scammers. (Even if you can find the person yourself, do not assume that a bank account holder is really the perpetrator. They might be hacked and used without the knowledge of the owner.)

If you lost money, definitely report it. Your bank (or e.g. paypal, if the scam was done via paypal) might also be able to help recover the money.

The most likely thing that happened here is a tech support scam. They are mostly stupid and straightforward.

The most likely thing that happened here is a tech support scam. These scams are mostly simple and straightforward.