Screen-Sharing App Fraud: AnyDesk, TeamViewer and Your Bank

Screen sharing fraud is the one scam that uses honest software. AnyDesk, TeamViewer QuickSupport, RustDesk and their relatives exist so that a technician can see and fix a device from somewhere else, and they do that job well. In the wrong hands, the same feature lets a stranger sit beside you, invisibly, while you open your bank app and type your PIN. No malware is needed. You install the tool yourself, because someone polite asked you to.

This explainer covers who asks, what they see, what to do in the minutes after you realise, and how to clean the phone so the problem does not continue after the call ends.

How screen sharing fraud is set up

The caller

The request comes wrapped in a problem you want solved. A "bank executive" calling about a stuck refund or a card issue. A planted customer care number you dialled yourself. An "electricity officer" who needs to update your bill record, as in the electricity bill scam. A "courier" sorting out a delivery charge. An "insurance" agent processing a maturity payment. In each case there is an error that only they can see, and they need your screen to fix it.

The install

You are guided to the Play Store or App Store to install AnyDesk or TeamViewer QuickSupport, which look legitimate because they are. The app displays a nine-digit code or an ID. The caller asks you to read it out so they can "connect to the support session". You accept the incoming connection request. Both apps show warnings about scams on this screen; the caller says those are standard and to tap Accept.

The session

They now see your screen in real time. They ask you to open your bank app "to check the refund status" and log in. They see your balance. They ask you to initiate a small test transaction, or they have already set one up on their side; the OTP arrives on your phone, visible on your screen, and they use it before you have read it. If you granted control or accessibility permission during setup, they can open apps, read SMS and type without your help. Some install a second app that forwards SMS afterwards so the sessions do not need to continue.

Newer versions use WhatsApp screen share, which was added to video calls in 2023. The caller starts a video call and asks you to tap the share-screen button so they can "see the issue". No install is needed, and the effect is identical.

How to recognise it in the first minute

What to do if you are connected right now

Switch the phone to flight mode. That cuts the session instantly, whatever the caller says. Then uninstall the remote access app. Then, from another device if possible, change your net-banking password and your email password. Call your bank's fraud line on the number printed on your card and ask for cards, UPI and net banking to be blocked for the day while you check the account. If any transaction has gone through, dial 1930 with the details so the receiving account can be frozen, file on cybercrime.gov.in, and write to the bank the same day. The order of steps is on our reporting page.

The three-day rule applies here. Under the RBI's 6 July 2017 circular on unauthorised electronic banking transactions, a customer who reports third-party fraud within three working days bears zero liability. Banks commonly argue that a transaction authenticated on your own device with your own OTP was yours. The answer, in writing, is that a third party obtained access to the device by deception, which the circular covers; our Ombudsman guide shows how to frame it. (Source: RBI circular DBR.No.Leg.BC.78/09.07.005/2017-18.)

Cleaning the phone afterwards

Uninstalling the app you can see is not enough if the caller had control for any length of time. Go through Settings → Apps and remove anything you did not install. Check Settings → Accessibility and Settings → Security → Device admin apps for entries you do not recognise, and revoke them. Check which apps have SMS permission. Run a Google Play Protect scan. If you are not confident, a factory reset is the dependable option: back up photos and contacts, reset, set the phone up fresh, and reinstall banking apps from the official store. Re-register UPI afterwards, and ask the bank whether any new device was registered on your account during the session.

If a transaction went through, the bank's investigation may ask for the app's connection log, which AnyDesk and TeamViewer keep on the device; take screenshots of the session history before uninstalling if you can do so safely. Our personal cyber safety checklist covers the settings to keep after the clean-up, and our device and privacy audit does the clean-up and the checks with you if you would rather not do it alone.

Why it keeps working

Because the tool is real, the store is real, and the person is helpful. Older users in particular are used to a relative or a shop technician taking the phone to fix something, and a remote session feels like the same thing. The defence is a rule rather than a judgement: nobody connects to my phone, ever. Our UPI fraud guide lists this alongside the other tricks that end at the PIN. The category overview is on the online financial fraud page.

After any loss, a "recovery agent", "bank reversal team" or "cyber lawyer" will call, knowing the exact amount, and ask for a fee to retrieve it. The details came from the gang. Nobody can guarantee recovery and no agency contacts victims unasked. Our financial fraud response service handles the bank and police follow-ups for a fixed fee agreed up front.