What are the warning signs of a remote-access bank takeover?

Watch for: Asked to install AnyDesk, TeamViewer or LogMeIn; Pressured to move money to a 'safe' account; Caller knows some real details about you; Won't let you hang up and call the bank back.

How can I tell if this is a scam?

Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.

What should I do if I clicked the link or replied?

Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Hang up. Real banks never ask you to install remote-access software. Call your bank using the number on the back of your card. If you installed the app, uninstall it and call IDCARE on 1800 595 160.

What should I do if I already sent money?

Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.

Where should Australians report this scam?

Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.

All scams

🛜

Remote-access bank takeover

'Bank fraud team' walks you through installing screen-share software.

Senior

How it works

A caller claims to be from your bank's fraud team. They tell you criminals are draining your account and you must install AnyDesk / TeamViewer to 'protect' it — then they watch you log in and transfer your money to a 'safe' account they control.

Common scenarios to watch for

This scam shows up in several different shapes. Recognise the pattern, not just one message.

Reporting locationHotlines on the printed checklist will match this location.

AnyDesk 'fraud team' install

Caller talks you through installing AnyDesk to 'protect' your account, then watches you log in.

"ANZ Fraud — please install AnyDesk so we can lock your account from this end."

Red flags to spot

Are you being asked to install remote access software (AnyDesk, TeamViewer)?
Did the caller claim to be from your bank's fraud team?
Are they asking you to log in to your bank while they watch?
Did they contact you unsolicited — you didn't call them first?

'Police partnership' sting

Caller claims you're helping a real police investigation by transferring funds to a 'decoy account' so they can catch criminals.

"Detective Walsh, Fraud Squad — we need you to transfer $20k to this account to draw out the suspect. Confidential."

Red flags to spot

Is someone claiming to be police and asking you to transfer money?
Are you told the transfer is 'confidential' and not to tell anyone?
Did they provide a badge number you can verify with the real police station?
Are you being told this will 'help catch criminals'?

Fake refund overpayment

Caller from 'your bank' refunds a 'mistaken fee' but 'accidentally' deposits $5k extra — and pressures you to wire it back to a mule.

"I've credited your $50 refund — oh no, I sent $5,050 by mistake. Please send the $5,000 to this account, my job is on the line."

Red flags to spot

Did the caller 'accidentally' over-refund your account?
Are they pressuring you to send the difference back immediately?
Is the refund amount visible in your actual bank app?
Are they using emotional manipulation ('my job is on the line')?

Red flags

🚩Asked to install AnyDesk, TeamViewer or LogMeIn
🚩Pressured to move money to a 'safe' account
🚩Caller knows some real details about you
🚩Won't let you hang up and call the bank back

What to do

1Hang up. Real banks never ask you to install remote-access software.
2Call your bank using the number on the back of your card.
3If you installed the app, uninstall it and call IDCARE on 1800 595 160.

Who's targeted

Older banking customers comfortable taking phone instructions.
Anyone listed in recent data breaches the scammer can quote from.

Why it works

Caller already knows real details (DOB, recent transactions).
Stress + remote access lets the scammer impersonate you in real time.

Common variations

Different shapes of the same scam — recognise the pattern.

1Bank 'fraud team' calling about blocked transactions.
2Police / AFP 'investigation' requiring secrecy.
3Crypto exchange 'security' team needing screen share.

If you've already been scammed

1Disconnect the device and uninstall the remote-access app.
2Call your bank from another phone using the number on your card.
3Reset all passwords from a different, clean device and call IDCARE.

Frequently asked

Will a bank ever ask me to install AnyDesk?▾

Never. No legitimate bank uses remote screen-share on customer devices.

They knew my balance — does that prove it's real?▾

No — data breaches leak account details. Hang up and call back.

Am I liable for the loss?▾

Often the bank covers it under the new scam codes — file a complaint fast.

Questions people ask about this scam

How does the remote-access bank takeover work?: A caller claims to be from your bank's fraud team. They tell you criminals are draining your account and you must install AnyDesk / TeamViewer to 'protect' it — then they watch you log in and transfer your money to a 'safe' account they control.
What are the warning signs of a remote-access bank takeover?: Watch for: Asked to install AnyDesk, TeamViewer or LogMeIn; Pressured to move money to a 'safe' account; Caller knows some real details about you; Won't let you hang up and call the bank back.
How can I tell if this is a scam?: Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.
What should I do if I clicked the link or replied?: Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Hang up. Real banks never ask you to install remote-access software. Call your bank using the number on the back of your card. If you installed the app, uninstall it and call IDCARE on 1800 595 160.
What should I do if I already sent money?: Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.
Where should Australians report this scam?: Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.

General scam awareness information. ScamShield AI cannot guarantee that every scam will be detected or that a message is legitimate.

Check a message like this Report & next steps