PanicStation.org
UK USA
us Technology & digital loss

What to do if…
you suspect someone has remote access to your computer because the cursor is moving on its own

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Disconnect the computer from the internet now, then secure your email, banking, and main Apple, Google, or Microsoft account from a different trusted device.

Do not do these things

  • Don’t keep using the suspected computer to log into email, banking, shopping, crypto, tax, or password-manager accounts.
  • Don’t accept help from anyone who contacted you first through a call, pop-up, email, text, or chat message claiming to be support.
  • Don’t install unfamiliar security tools or grant remote access to anyone to fix the problem.
  • Don’t type passwords, Social Security numbers, card details, or recovery codes into any site opened from a pop-up, ad, message, or search result.
  • Don’t move money because a caller, pop-up, or supposed support person says it is needed to protect it.
  • Don’t factory reset a work or school computer without instructions from your IT or security team.

What to do now

  1. Isolate the computer from the internet.
    Turn off Wi-Fi and unplug Ethernet. If you can do it quickly, turn off Bluetooth too. If the computer still appears to be controlled and you cannot safely regain control, hold the power button to shut it down.

  2. Use a separate trusted device to secure the accounts that could unlock everything else.
    Do this from a phone, tablet, or computer you trust, not from the suspected computer. Start with:

    • Email
    • Banking and payment apps
    • Your Apple, Google, or Microsoft account
    • Your password manager, if you use one

  3. Change key passwords and end other sessions where the account allows it.
    Use new, unique passwords. Choose “sign out of all devices,” “log out of other sessions,” or similar wording where available. Turn on multi-factor authentication if it is not already on.

  4. If money may be at risk, contact the bank or payment provider directly.
    Use the number on the back of your card, the bank’s official app, or a known official website typed in yourself. Say that you suspect remote access to your computer and ask them to check for suspicious activity, block unsafe transactions, and secure the account.

  5. If this is a work or school device, contact IT or security now.
    Tell them you suspect unauthorized remote access, describe what you saw, and say that you disconnected the device from the internet. Follow their instructions before scanning, deleting files, or resetting anything.

  6. Make a short record without spending long on proof.
    Write down the date, time, what moved or opened, any names of pop-ups or callers, and any accounts you used on the computer recently. If it is safe, take a quick phone photo or video of the screen.

  7. Only after the urgent accounts are protected, look for obvious remote-access signs if you can do so while offline.
    Look for unfamiliar remote-control apps, new administrator accounts, unknown browser extensions, recent installs you do not recognise, or settings that allow remote login. Do not click pop-ups, unknown files, or links while checking.

  8. Keep the computer offline until you have a safe clean-up plan.
    If reputable security software is already installed, you may be able to run an offline scan. Reconnect only when you are confident active remote control has stopped, or get help from a trusted repair provider, your device maker, or your IT team.

  9. Report after urgent protection steps if there was fraud, account takeover, identity theft, or a scam contact.
    Use IC3 for cyber-enabled crime or fraud reports. Use IdentityTheft.gov if personal information may have been stolen or used. Use FTC scam guidance if this started with a fake support call, pop-up, refund message, or impersonation.

What can wait

  • You do not need to prove exactly how access happened right now.
  • You do not need to decide right now whether to wipe or replace the computer.
  • You do not need to secure every account this minute; start with email, banking, payment, password-manager, and main device accounts.
  • You do not need to argue with a caller, reply to a message, or explain yourself to anyone pressuring you.

Important reassurance

Cursor movement can have ordinary causes, such as a faulty mouse, a stuck touchpad, a wireless mouse issue, accessibility settings, or lag. Treating it as possible remote access for the next short while is still a sensible way to protect accounts and money without needing to be certain yet.

Scope note

These are first steps only to reduce harm, preserve options, and buy time. Later decisions may need help from a trusted technician, your bank, your workplace or school IT team, an account provider, or a reporting agency.

Important note

This is general information, not legal, forensic, financial, cybersecurity, or professional advice. If you believe you are in immediate danger or someone is actively threatening you, call 911.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us