PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
you receive a notification that screen sharing or remote management was enabled without your consent

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Disconnect the affected device from the internet now, then use a different trusted device to secure the accounts that could control it.

Do not do these things

  • Don’t click “Allow”, “Trust”, “Share screen”, “Give control”, or similar prompts you did not request.
  • Don’t call phone numbers shown in pop-ups, warnings, emails, or messages claiming to be support.
  • Don’t use the affected device for banking, email, password managers, work logins, or identity checks until you have contained the issue.
  • Don’t delete remote-access apps, profiles, new users, or logs before recording their names if you may need evidence.
  • Don’t confront someone you suspect while they may still have access to your device or accounts.

What to do now

  1. Disconnect the affected device.
    Turn on flight mode if available, turn off Wi-Fi, unplug Ethernet, and disconnect any mobile hotspot. Leave the device powered on if you can do so safely, so the notification and evidence remain visible.

  2. Record what you can see.
    Use your phone or another device to photograph the notification, time and date, app name, account name, device name, and any wording such as “Screen Sharing”, “Remote Management”, “Remote Desktop”, “Quick Assist”, “AnyDesk”, “TeamViewer”, or “device is managed”.

  3. Do not approve or continue any remote session.
    If a remote-control window is open, choose the option to leave, end, cancel control, or stop sharing. If you cannot tell which button is safe, keep the device disconnected and move to account security from another device.

  4. Check whether management is expected.
    If this is a work or school device, or if it has work or school accounts on it, stop using it and contact your organisation’s IT or helpdesk using a known internal route. Remote management can be legitimate on managed devices, but IT should confirm whether this change was expected.

  5. Look for visible remote-access settings without reconnecting.
    On a Mac, check Sharing settings for Screen Sharing, Remote Management, Remote Login, and any management profiles. On Windows, check Remote Desktop, Remote Assistance, Quick Assist activity, installed apps, and user accounts. If a setting is greyed out or says the device is managed, write down exactly what it says rather than trying to bypass it.

  6. Secure controlling accounts from a different trusted device.
    Start with your email account, then Apple, Microsoft, Google, and any work sign-in. Change passwords to strong unique passwords, turn on multi-factor authentication where available, sign out of other sessions, and remove devices or app access you do not recognise.

  7. Check for new admin users, profiles, and remote tools.
    Write down or photograph any unknown administrator account, device management profile, remote-control app, browser extension, or recently installed software. If you are confident it is not legitimate and you do not need it as evidence, uninstall it; if you are unsure, ask IT or a trusted technician first.

  8. Decide whether the device needs a clean reset.
    If remote access may have been active, or you find unknown admin access or management profiles, the safer route is usually a full reset or reinstall and restoring only from a backup made before the problem started. If the device contains work data, coordinate this with IT first.

  9. Report it if it appears criminal, involves money, or affects identity or work data.
    For England, Wales, or Northern Ireland, use Report Fraud for cyber crime or fraud. If you live in Scotland or the crime happened there, contact Police Scotland on 101 for non-emergencies. If an active crime is happening now or someone is in immediate danger, call 999.

What can wait

  • You do not need to work out who did it right now.
  • You do not need to replace the device today.
  • You do not need to tidy files, run every possible scan, or do a full investigation before securing your email and main accounts.
  • You do not need to reply to messages, pop-ups, or callers claiming they can fix it.

Important reassurance

A remote access notification is unsettling, but the first useful steps are simple: disconnect the device, keep a small record of what appeared, and secure the accounts from another device. Doing those things reduces the chance of further access while you decide what help you need.

Scope note

These are first steps only. Later decisions, such as forensic checking, workplace reporting, fraud reporting, insurance, or a clean reinstall, may need specialist help from IT, your bank, a trusted technician, or official reporting channels.

Important note

This is general information, not legal, technical, financial, therapeutic, or professional advice. Device menus and wording vary, so use official support or trusted IT help if you cannot safely verify a setting.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us