1. Who started it?
I requested help from a company I know → go to 2.
Someone called or wrote without warning → do not install the app. Hang up and contact the company yourself.
2. Did you verify the contact yourself?
Yes, I used a number from my contract, app, or the official website → go to 3.
No, I am calling a number from the message or the caller → stop. That is not an independent check.
3. Is the purpose specific?
Yes: I know what problem will be fixed, on which device, and for how long → go to 4.
No: “security check”, “suspicious transfer”, or “protecting your money” → do not grant access.
4. Does the support involve a bank, code, or password?
Yes → stop. Technical support does not need to watch a bank login, read a text-message or BLIK code, or approve a transfer.
No → go to 5.
5. Can you limit the session?
Close email, banking, and documents. Back up the data involved. Do not enable unattended access. Read every permission request and end the session when its stated purpose is complete.
If the person refuses to work while the screen remains visible, asks you to disable protection, or will not give a support ticket number → stop.
6. What happens after the session?
End the connection in the app, disable unattended access, and refresh or revoke the session password or code if the application provides that option. If you no longer need the app, uninstall it. Check that no new user, extension, or startup program was added.
If it was a mistake
- Disconnect the device from the internet and end the session.
- From another device, call the bank if banking, a card, or a code was on screen.
- Change the email password and passwords for other visible accounts; sign out unfamiliar sessions.
- Keep the number, messages, app name, time, and session ID.
The remote-support scam article shows the full call pattern. A request from a friend is a separate version: the BLIK friend scam. A link to “collect money” is covered in the fake OLX or Marketplace payment page.