What to do after a scammer had remote control of your Mac

Why it happens

Fake support callers ask you to switch on screen sharing or install a remote-control app so they can use your Mac from far away. That access can stay switched on after the call ends. Turning it off, removing their app and changing your passwords shuts the door behind them.

How to fix it

1. Disconnect from the internet first. Click Wi-Fi in the menu bar and turn it off, or unplug the network cable. This cuts off anyone still connected.

2. Open System Settings, click General, then Sharing. Turn off Screen Sharing, Remote Management and Remote Login if any of them are on.

   General›Sharing

3. In Finder, choose Go, then Applications. Find any app the caller asked you to download, often one you don't remember installing yourself. Quit it first with Command-Q, then drag it to the Trash.

   Finder›Go›Applications

4. Open General, then Login Items & Extensions. Remove anything you don't recognise from Open at Login, and turn off unknown items under App Background Activity (Background App Activity on macOS 27).

   macOS 26 Tahoe General›Login Items & Extensions›App Background Activity

   macOS 27 Golden Gate General›Login Items & Extensions›Background App Activity

5. Open Privacy & Security, then Screen & System Audio Recording, and turn off any app you don't recognise. Do the same in Accessibility, where remote-control apps often ask for access.

   Privacy & Security›Screen & System Audio Recording

6. Turn Wi-Fi back on. Then change your passwords, starting with your email and your Apple Account: click your name in System Settings, then Sign-In & Security, then Password. If you can, use a device the caller never touched.

   Apple Account›Sign-In & Security›Password

7. If you typed bank details or a card number, or the caller asked you to pay for anything, call your bank now using the number on the back of your card.

On macOS 26 the switches for apps running in the background are listed under App Background Activity. On macOS 27 the same list is called Background App Activity.

Still not fixed?

1. Change your Mac login password too, in Touch ID & Password by clicking Change… next to Password. On a Mac without Touch ID, the pane is called Login Password.

   Touch ID & Password›Password›Change…

2. Check which devices use your Apple Account. Click your name in System Settings, then Devices, and remove any you don't know.

   Apple Account›Devices

3. If General shows Device Management with a profile you didn't add, the caller may have installed it. Open it to see what's there, and remove a profile only if you're sure it isn't from your work or school.

   General›Device Management

4. Report the scam to your bank and your local police or fraud reporting service. Keep any phone numbers, emails or payment details from the call.

5. If someone calls again saying they're from Apple, hang up. Contact Apple yourself instead, using Apple's own website or the Apple Support app on an iPhone or iPad.

6. If you're still not sure your Mac is clean, or you can't remove something, contact Apple Support. They can talk you through your options, including erasing your Mac with Erase All Content and Settings after you've backed up your files.