Remote Access Scam Defense 2026: How to Stop ScreenConnect, AnyDesk, and TeamViewer Hijacks Before Money Leaves Your Account

Last quarter one of my long-standing clients — a small hotel I help run a property-management system for — called me in a panic. Their front-desk manager had just installed something called "QuickSupport Update" because a "Microsoft engineer" said her Outlook was leaking. By the time I drove over, the attacker had already opened a browser to her business banking site and was clicking through the wire-transfer flow. We pulled the Ethernet cable out of the back of the desktop and the session died. No money left the account that day, but it was close — and the attack itself used software that was, technically, completely legitimate: ConnectWise ScreenConnect.

That is the new shape of the 2026 tech-support scam. It is not malware in the classic sense. Attackers no longer need a zero-day to drain an account — they just need to talk a tired person into double-clicking a signed installer. In my experience handling production access for 7 aggregator sites and 50+ client projects at wardigi.com, the same remote-management tools my team uses for legitimate support are now the single most abused attack surface against the people I am trying to protect.

This guide is the checklist I now hand out after that incident. It is written for home users and small-business owners, not security teams.

What Actually Changed in 2026

The FBI's 2024 IC3 report (the most recent full-year data published, May 2026) logged $1.46 billion in losses to "Tech/Customer Support" scams across 17,500+ complaints — a 50% increase over the 2022 figure of roughly $806 million. The same report notes that victims aged 60+ accounted for more than half of those losses, but a quieter trend hides in the small-business numbers: median loss per incident has climbed from around $1,300 in 2023 to roughly $2,400 in early-2026 FTC Sentinel reporting. The reason is simple — attackers stopped asking for gift cards and started asking for wire transfers and crypto.

The toolkit shift matters even more than the dollar figure. CISA's joint advisory AA23-025A first warned about malicious use of Remote Monitoring and Management (RMM) software in early 2023. By 2026 the pattern is industrial:

• ScreenConnect (ConnectWise) — the binary is digitally signed by ConnectWise, so Windows SmartScreen and most home antivirus suites do not flag it. Attackers send pre-configured installers that auto-connect to their server, not the user's IT provider.
• AnyDesk — pushed as "QuickSupport" or "TeamViewer alternative." AnyDesk's own abuse-prevention page now lists nine separate fraud patterns it has documented since 2024.
• TeamViewer QuickSupport — still the entry point for the old "Walmart refund" and "Amazon order" scripts the FTC continues to publish warnings about.
• Atera, Splashtop, Action1, LogMeIn Rescue — newer entrants that flew under most blocklists through 2025.

The 2026 wrinkle, confirmed in the May 10, 2026 BlueScreen Computer write-up and corroborated by several MSPs I trade notes with, is that scammers now instruct victims to type a URL into the Windows Run dialog (Win+R) rather than opening a browser. That bypasses browser-based phishing filters entirely and downloads a renamed installer straight from a CDN. I tested this on my own throwaway VM in April 2026 — Microsoft Defender raised zero alerts on a ScreenConnect installer renamed to "SSAUpdate.exe" because the signature was valid.

The Attack Script, Beat by Beat

Every successful remote-access scam I have helped a client recover from in the last 18 months followed the same five-beat script. Recognising the script is the cheapest defense you can deploy — no software, no subscription.

Beat 1 — the hook. A pop-up freezes the browser with an alarming voice ("Your computer has been infected, call Microsoft at 1-888-..."), or a text message claims a $499 antivirus auto-renewal, or an email arrives styled as a Social Security Administration benefits statement. The 2024 ScreenConnect campaign described by PCrisk used exactly the SSA lure with a "PDF viewer" download that was actually a pre-configured ScreenConnect client.

Beat 2 — the call. The victim calls a number controlled by the attacker. The "agent" is polite, scripted, and patient. They will spend 20 minutes building rapport before asking for anything.

Beat 3 — the install. "I need to verify your computer is clean. Please press Windows key plus R, then type this address." The victim installs the remote-access client. The attacker is now on the keyboard.

Beat 4 — the misdirection. The attacker opens cmd.exe, runs harmless commands like netstat and tree, and narrates them as proof of infection. Meanwhile they black out the screen ("running a deep scan, do not touch the mouse") and pivot to the banking tab.

Beat 5 — the drain. Wire transfer, crypto purchase via Bitcoin ATM, or — increasingly common in 2026 — a Zelle push to a money mule. The FBI's Boston field office public warning documented average losses of $1,300 per victim with individual cases reaching $5,000+.

Defense Layer 1: Stop the Install (For Home Users)

The single highest-impact control is preventing the remote-access binary from running in the first place. On Windows 10/11 Pro and Enterprise, Windows Defender Application Control (WDAC) or the simpler AppLocker can blocklist specific publishers. For Home edition users without those features, the next-best lever is Controlled Folder Access plus a host-file or DNS-level block. Here is what I deploy on my parents' machines:

1. Turn on Microsoft Defender's "Block at first sight" and "Cloud-delivered protection." Settings → Privacy & security → Windows Security → Virus & threat protection → Manage settings. Both must be On.
2. Add a DNS-level block. Switch your home router to NextDNS, Control D, or Cloudflare's 1.1.1.3 family DNS. NextDNS lets you blocklist domains like *.screenconnect.com, *.anydesk.com, and *.teamviewer.com if no one in the household legitimately needs them. I run this on my mother's network — it has blocked four installer-download attempts in 14 months according to NextDNS logs.
3. Disable Win+R for non-admin accounts. The Run dialog is the new download vector. On Windows Home, use Local Group Policy alternatives via the registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer → set NoRun to 1 for the non-admin daily-driver account.
4. Run as standard user. If the daily account is not a local administrator, the ScreenConnect installer will prompt for credentials the victim does not have — a friction point that has broken the script for at least two clients I know personally.

Defense Layer 2: Block the Money Movement

If layer 1 fails, the goal shifts to making the drain step impossible. From 11+ years of building POS and ERP systems that move money, the controls I trust most are the ones the user does not have to remember in the moment:

• Wire transfer hold. Most US banks will, on request, add a 24-hour or even 72-hour hold on outgoing wires above a threshold (Chase, Bank of America, and Wells Fargo all offer this as of 2026, though you usually have to ask twice). My recommendation: set the threshold to whatever amount you are not comfortable losing. For most households that is $1,000.
• Daily Zelle/RTP cap. Zelle pushes are irreversible and they are the 2026 scammer favourite. Most banks let you set a daily cap as low as $500. Ask explicitly — it is rarely in the default settings menu.
• Crypto exchange withdrawal whitelist. Coinbase, Kraken, and Gemini all support withdrawal-address whitelists with a 24-48 hour cooling-off period for new addresses. Turn this on today.
• Separate "operating" and "savings" accounts at different institutions. Keep the daily-driver debit card at one bank and the bulk of savings at another with no online transfer link. Tedious; effective.

Defense Layer 3: Small Business Specifics

For small businesses — bookkeepers, dentists, hotels, e-commerce shops, the kind of clients I support at wardigi.com — the home-user controls are not enough. Three additions I now build into every onboarding:

1. RMM blocklist via group policy or MDM. If you use Microsoft Intune, Jamf, or a similar device-management tool, add ScreenConnect, AnyDesk, TeamViewer, Splashtop, Atera, and Action1 client executables to the application blocklist unless your IT provider is one of them — in which case allowlist only the specific signed version they deploy. I built a hash-allowlist for one client's small POS estate after the hotel incident; it took three hours and would have stopped the original attack at zero cost.

2. Call-back verification protocol. Any incoming call claiming to be from Microsoft, Google, your bank, your accounting software vendor, or the IRS is a scam by default. Train staff to hang up and dial back using a number printed on the company's own records or the back of the corporate card — never a number the caller provides. The FTC's tech-support-scam guidance has made this the headline recommendation for three years running for good reason.

3. Out-of-band wire confirmation. No wire transfer above an agreed threshold goes out without a verbal confirmation on a known-good phone number. For the ERP and POS systems I have shipped, the implementation is a workflow gate — the system flags the transfer for a second approver who must phone the requesting party. Sounds bureaucratic; saves the company on the day someone deepfakes the CEO. Across the ten clients where I have deployed this gate, it has caught two attempted business-email-compromise wires in 2025-2026.

If You Are Mid-Incident: The First 10 Minutes

This is the section I wish my hotel client's manager had seen on a Post-it. Print it.

1. Disconnect physically. Pull the Ethernet cable or hold the Wi-Fi button until it turns off. Do not just close the lid or hit the power button — both can leave a remote session alive briefly.
2. Call your bank's fraud line from a different phone. Use the number on the back of your physical card, not the number on the screen and not any number the "agent" gave you. Tell them: "I just had a remote-access tech-support scam on my computer. Freeze outgoing wires, ACH, and Zelle right now."
3. Change critical passwords from a clean device. Banking, email, password manager. Phone, tablet, or a different laptop is fine — not the compromised machine.
4. Revoke active sessions. In Gmail/Outlook/your banking portal, find "active sessions" or "where you are signed in" and sign everything out. Then rotate the password.
5. Run an offline scan. Boot the compromised machine from a Windows Defender Offline USB or take it to a trusted shop. Do not just "uninstall ScreenConnect" — assume credential theft has already happened.
6. File reports. FBI IC3 within 72 hours (the window where wire recall is realistic), then FTC ReportFraud. If money moved, also file a local police report — your bank's fraud team will ask for the case number.

What Does Not Work (And Wastes Time)

A few defenses I see recommended online that I have stopped suggesting:

• "Just use a Mac." ScreenConnect, AnyDesk, and TeamViewer all have macOS clients. The 2024 Microsoft Threat Intelligence report on storm-1811 documented identical attack patterns against Mac users.
• "Install three antivirus tools." They conflict, they slow the machine, and none of them flag a signed RMM binary by default. One reputable AV (Microsoft Defender is fine on Windows 11) plus the controls above beats stacking products.
• "Cover your webcam." Useful for a different threat, irrelevant here. The attacker does not need to see you; they need your bank login.
• "Use a VPN." VPNs do not stop voluntary installs. A VPN protects traffic confidentiality; it does nothing about a scam-installed remote tool that traverses the encrypted tunnel cheerfully.

The Quiet Pattern Behind All of This

Eleven years of shipping production software has taught me one thing about security: the attacks that work in volume are the ones that turn legitimate tools into weapons. SQL injection rides on the same database client your developers use. Phishing rides on the same email infrastructure your CEO uses. And remote-access scams ride on the exact same software my team uses to fix a broken POS terminal at 2 a.m. The defense is not a magic tool — it is layered friction at the steps where the attacker is most vulnerable: the install, the impersonation, and the money movement.

Pick three controls from this article and turn them on this week. DNS-level RMM blocking, a Zelle daily cap, and a printed call-back protocol cost zero dollars and would have stopped my hotel client's incident before the front-desk manager ever picked up the phone.