So, my friend got his computer “locked” and there was a number to call a Microsoft support agent. He called it and talked to him for awhile, and he got talked into letting the scammer remotely access his computer and took him to the registry where it shows all the area and started trying to sell him an anti-virus. Once he started being marketed to, he hung up and turned the wi-fi and his laptop off. He has tax documents on his computer with private information, so just to be safe I had him file a fraud alert with TransUnion.
I was wondering, if he watched the guy remotely access his computer the whole time and the scammer never tried opening up any documents or anything, how likely is it that any files or personal information were taken? I told him to also keep an eye on bank statements and credit card statements to be extra safe. His passwords aren’t saved on his browser or anything, but I read somewhere they could have stolen his cookies and use those to log into some accounts? I don’t know, I’m just worried but I think I’ve had him take all the necessary precautions for now. Are there any other steps I should have him take?
I see plenty of these situations.
How long did he have access?
Typical MO of scammers is to collected any cached data typically from browsers, like saved passwords, accounts, and other information. Anything that’s easy enough to grab quickly.
In most cases it’s a simple installation of a remote software, sometimes easy to find, sometimes hidden deep in appdata folders with gibberish names that look like temp files.
Safest bet is to change all passwords and wipe the PC. Of course.
You can also check the system event logs and see if there where any installations during the time the scammer had access. Likely as soon as the scammer achieved access.
Best of luck! A hard lesson but hopefully a lesson well learned.