A tool for managing user identities, credentials, and access across on-premises and cloud environments
The behavior described during the Quick Assist session is inappropriate and matches patterns Microsoft warns about when using any remote assistance tool. Only trusted helpers should ever be allowed to connect, and any unprofessional or suspicious actions during a session are a reason to end it immediately.
Actions to take now:
- Stop and prevent further access
- If Quick Assist or any other remote session is still active, disconnect immediately.
- Do not allow that helper, or anyone else who contacts unexpectedly, to reconnect to the device.
- Protect the device and accounts
- Change passwords for important accounts (email, Microsoft account, banking, work accounts) in case anything sensitive was visible during the session.
- Run a full security scan with Microsoft Defender Antivirus or the organization’s security tool to ensure no unwanted software was installed.
- Report the incident
- Report the behavior as a suspected tech support or remote assistance abuse case using Microsoft’s reporting channels:
- Use the technical support scam form referenced in Microsoft guidance if this may have been a scam or misuse of remote access.
- For suspected scams or abuse, submit a report at https://www.microsoft.com/reportascam.
- If this support was provided by an employer, school, or another organization, report the incident to the organization’s IT/security team so they can investigate the specific helper.
- If there is concern about harassment or other misconduct, consider also notifying local authorities, especially if any threats, extortion, or other criminal behavior occurred.
- Report the behavior as a suspected tech support or remote assistance abuse case using Microsoft’s reporting channels:
- Future precautions with Quick Assist and remote tools
- Only allow a helper to connect when the interaction is initiated by contacting official support or a known, trusted person.
- Never allow remote access to anyone claiming to be “IT support” or “Microsoft support” who contacts unexpectedly.
- If at any point a helper does something unrelated, unprofessional, or suspicious (such as typing personal messages, browsing unrelated sites, or asking for credentials), end the session immediately.
These steps help protect the device, accounts, and personal information, and ensure the incident is visible to the appropriate support and security teams.
References:
- Use Quick Assist to help users
- Protect yourself from tech support scams
- Solve PC problems remotely using Quick Assist
- Avoid and report Microsoft technical support scams
- Protect yourself from online scams and attacks
- Solve PC problems remotely with Remote Assistance
- Who do I call for support? - Microsoft Q&A
- How do I report a possible scam from Microsoft? - Microsoft Q&A
- why can't you block AnyTech365.com....they are a scam company posing as Microsoft supported, stealing information? - Microsoft Q&A
- Microsoft Defender Scam or Do I have a virus on my computer - Microsoft Q&A