Remote access scams are the only fraud where the victim hands the attacker the keyboard. A caller - posing as IT support, a bank, the NBN, Telstra or Microsoft - talks your staff member into installing screen-sharing software such as AnyDesk, TeamViewer or Quick Assist, then watches their screen, lifts their passwords and moves money while they watch. Training staff to spot remote access scams comes down to one reflex nobody is born with: you never install software at a stranger's direction, no matter how official they sound.
TL;DR
- Remote access scams cost Australians $5.9 million in reported losses in 2024 and sat in the top five loss categories alongside investment, romance, payment redirection and phishing scams.
- The scam works because it hijacks trust in authority: a caller who knows your name and sounds like IT support walks the victim through installing screen-sharing software.
- The reflex that stops it: never install remote access software at a caller's direction, and never read out passwords, codes or bank details while someone else can see your screen.
- Remote access scams disproportionately impact older Australians, so the training should travel home with staff.
- Train it with scenario drills and a callback rule, then measure with phishing reports and human risk reporting.
Why this matters
The Australian Competition and Consumer Commission's Scamwatch data shows remote access scams were among the top five scam types by combined reported losses in 2024, part of a group - investment, romance, payment redirection, remote access and phishing - that accounted for more than 70 per cent of total combined losses that year. Reported losses to remote access scams alone were $5.9 million in 2024, and they fell to $4.2 million in the first nine months of 2025 as the pattern became better known - which is exactly the effect training sustains.
For a business the numbers understate the risk. A remote access scam that starts as a consumer-style cold call can end with the attacker inside a work laptop, reading the mailbox, harvesting VPN credentials and setting up a business email compromise attack against the finance team. The most expensive variant pairs the remote session with a fake bank call: the victim is told a fraudulent transfer is in progress and must authorise a reverse payment - which the attacker watches them perform, straight into the scammer's account.
Who this is for
MSPs training client workforces, internal IT and people teams, and finance and admin staff who handle payments. It is also worth pushing to every employee's home life, because the highest-loss group is older Australians - many staff have parents this scam targets directly.
What a remote access scam looks like
Staff should be able to name these patterns on sight:
- The cold call from IT. Someone calls saying your computer has been sending errors, viruses or security alerts, and offers to fix it right now. Real IT teams do not cold-call staff about problems they have never ticketed.
- The provider pretext. The caller claims to be from the NBN, Telstra, Optus, Microsoft, Apple or your bank, quoting a service outage, a refund or suspicious activity. They may read back your real name and address - that data is easy to buy.
- The install request. The payoff of every version: download this tool, open this link, type this code - and the caller can now see everything on the screen, including passwords typed into login pages and codes arriving by SMS.
- The browser pop-up. A full-screen warning - your computer is infected, call this number - that looks like an operating system message. Calling the number connects you to the same attacker.
- The bank-call combo. While the attacker is watching the screen, a second caller claiming to be the bank walks the victim through a transfer to stop the fraud, into the scammer's own account.
- The software itself. AnyDesk, TeamViewer, UltraViewer, Quick Assist and browser screen-sharing are legitimate tools - they are just never legitimate to install because a caller asked.
What all of them share: the victim performs the install themselves, and everything that follows looks like ordinary computer use.
The reflex: hang up, call back, never install
Email training taught the hover-and-check. Phone-based scams need their own three beats:
- Never install at a caller's direction. There is no scenario in a well-run business where a phone caller - internal IT included - has staff install screen-sharing software on request. Internal support uses the ticket system and company-managed tools.
- Hang up and call back on a number you already have. The bank's number is on the card, the invoice and the bookmarked website. Telstra's and the NBN's numbers are on their websites. A genuine caller will never object to a callback.
- Nothing private on a shared screen. Passwords, codes, invoices and bank details are never read out or typed while anyone else can see the screen - because in this scam, someone always is.
Two supporting habits round it out:
- Treat urgency as the tell. The caller's weapon is a problem that must be fixed this minute. Any request that punishes a five-minute pause is a request to refuse.
- Report it either way. At work, tell IT or the MSP even when nothing was installed - the same caller may have rung colleagues. At home, report to Scamwatch; if a loss occurred, also to ReportCyber and the bank immediately.
How to train it
- Run a scenario drill, not a lecture. Most phishing simulation platforms are email-based, so train this one as a five-minute tabletop: play the transcript of a cold call, ask the room what they would do at the install request, then debrief the hang-up-and-callback reflex.
- Fold it into monthly awareness training. A short story-driven module inside your security awareness training programme keeps the pattern fresh; one annual session decays within weeks.
- Target the risk roles. Finance, accounts payable, reception and admin answer unknown callers all day. Reception staff especially need authority to hang up without embarrassment.
- Cover the home angle. The same drill protects staff parents and grandparents - frame it as something worth sharing at the dinner table, not a compliance rule.
- Make reporting the win. A staff member who reports a suspicious caller before installing anything has delivered exactly the outcome the programme exists for. Track reports alongside click rates in your phishing simulation reporting culture.
- Write the callback rule into payment and support processes. No remote session is granted without a ticket from a known contact. The process control holds even on the day training fades.
What to do if someone already let them in
Speed limits the damage. Disconnect the device from the internet immediately, change passwords from a different device starting with email and banking, revoke active sessions, and check bank statements for transfers already made - then call the bank's fraud line on the number from the card. Report to ReportCyber and Scamwatch. If it happened on a work device, treat it as an incident: the attacker may have harvested mailbox credentials that fuel a later business email compromise attempt.
FAQ
What is a remote access scam?
A scam where a caller poses as IT support, a telco, a bank or a government agency and talks the victim into installing screen-sharing software such as AnyDesk or TeamViewer, giving the attacker live control of the computer.
How much do remote access scams cost Australians?
Scamwatch recorded $5.9 million in reported losses in 2024, falling to $4.2 million in the first nine months of 2025 - but reported losses understate the total, and the scam remains a top-five loss category.
Is AnyDesk or TeamViewer itself a scam?
No - both are legitimate tools. The scam is installing them at a stranger's direction, which no genuine IT team, bank or telco will ever request by phone.
How do I know if an IT call is genuine?
You hang up and call back on a number you already have - the ticket system, the bookmarked website, the number on the card. Genuine callers accept a callback; scammers need you to stay on the line.
What should I do if I already gave someone access?
Disconnect from the internet, change passwords from another device, revoke sessions, call your bank's fraud line and report to ReportCyber and Scamwatch.
Can we simulate remote access scams in training?
Not with real remote software. A scripted-call tabletop drill with a debrief works well, pairs naturally with email-based phishing simulations, and costs nothing.
One last thing
The single sentence that defeats every variant of this scam costs nothing: we never install software because a caller asked. Staff who can say that out loud, and back it with a callback, are safe from this one for life.