What to Do If Your Bank Reports Unauthorized Access From Your Own Device

Document Status: Published Author: Timothy Walker, TTT Enterprises LLC Category: Security Alerts & Incident Response

Overview

If your bank or financial institution informs you that an unauthorized transaction or login originated from your own computer or IP address, it is highly likely that your device has been compromised by a Remote Access Trojan (RAT).

Scammers use legitimate IT support software (like ScreenConnect, AnyDesk, or TeamViewer) to secretly control your screen, bypass Multi-Factor Authentication (MFA), and access your accounts using your saved browser passwords.

DO NOT use the compromised computer to check your bank account, change passwords, or search for help. The scammer may be actively watching your screen.

Follow this emergency protocol immediately to lock the scammer out.

Phase 1: The "Kill Switch" (Immediate Action)

You must immediately cut off the scammer's remote connection to your computer.

1. Disconnect the Internet Physically: Unplug the Ethernet cable from the back of your computer.
2. Disable Wi-Fi: If you are on Wi-Fi, turn off your home router by unplugging its power cord from the wall. Alternatively, put the compromised computer into "Airplane Mode."
3. Verify Disconnection: Attempt to load a random website (like weather.com) on the compromised computer. It should fail to load.

Phase 2: Damage Control (Using a Safe Device)

Now that the scammer is blind, you must secure your accounts using a device they do not control.

1. Switch to a Safe Device: Grab your smartphone or a tablet.
2. Use Cellular Data: Disconnect your smartphone from your home Wi-Fi network and switch to cellular data (LTE/5G) to ensure you are on a completely secure connection.
3. Contact Your Bank Directly: Call your bank's fraud department. Only use the official phone number printed on the back of your debit or credit card. Do not use Google to search for the number, as scammers frequently buy fake ads with fraudulent phone numbers.
4. Report the Incident: Inform the representative that your computer was compromised remotely. Ask them to freeze the account, halt pending transfers, and dispute the unauthorized charges.

Phase 3: Digital Triage (Securing Your Identity)

With the bank notified, you must secure the accounts the scammer will use to try and regain access.

1. Secure Your Email First: Using your safe smartphone, log into your primary email account (Gmail, Outlook, Yahoo, etc.). Change the password immediately and ensure Enforced MFA is turned on. Scammers use compromised email accounts to intercept password reset links for other services.
2. Change Bank Passwords: Still using your safe smartphone, log into your online banking app or website and change the password to a strong, brand-new phrase.
3. Revoke Trusted Devices: In your bank and email security settings, find the option to "Sign out of all devices" or "Revoke trusted devices" to force MFA prompts on all future logins.

Phase 4: Remediation (Cleaning the Computer)

Do not reconnect the compromised computer to the internet until it is thoroughly cleaned.

1. Uninstall Remote Software: Go to "Add or remove programs" and uninstall any remote support software you do not explicitly use for work.
2. Run Offline Scans: Run a full, offline scan using Windows Security or a reputable antivirus program.
3. Seek Professional Help: If you are not 100% confident that the machine is clean, leave it disconnected and hit the Call button at the top of the screen 📞