Solved Mother fell for remote access phone scam - what were they after?

[cwan]

Today my mother fell for a phone scam - the scammers called out of the blue, pretended to be from an ISP, used the Event Viewer to convince her there was something wrong with the computer's (Windows 7 Desktop) internet connection, and got her to install Teamviewer and presumably give them access (she doesn't remember what happened exactly, but she says she followed all their instructions). After doing everything they wanted, then they said that it was all fine but they wanted to speak to the account holder who was my father - he wasn't there at the time. Anyway, they called back in the evening, and I pretended to be my father. I played along up to the part where they wanted me to give them the Teamviewer ID and password and then hung up. Since then I've deleted Teamviewer and have run Malwarebytes Anti-Malware and Superantispyware which didn't turn up anything that looked too serious.

My question is: what were they after? Presumably money, but I note the following:
1) At no stage with the conversation with my mother or me did they mention payment or credit card details
2) The computer seemed to be working fine, with no obvious changes like new password checks/bricking/ransomware/new software (other than Teamviewer)
3) I can't work out why they would have wanted to talk to the account holder when they presumably got remote access already via my mother who believed them

I'm not sure what I'm missing and any insight would be much appreciated.

 

[1PW]

Snip, snip...
My question is: what were they after? Presumably money...
Snip, snip...

You are correct. Please pardon my abruptness but no further speculation is really required regarding scams. You did well to not lose any money.

Cheers.

 

[Layback Bear]

They were after money, passwords, banking or credit card information.
Basically anything they can steal and use or sell.

If they got into your mothers computer in any fashion you still could have problems.

I recommend to play it safe.
Replace all passwords to everything.
Contact your banks and credit card companies and notify them that your password and account could of been compromised. Then follow their instructions.

 

[MoxieMomma]

Hi:

Just to add a bit to what the others have suggested.

Yes, it would be a good idea to change all of one's passwords and other online credentials.
To be safe, this ought to be done from a different, known-clean computer, rather than from the one involved in the scam, until that system has been checked.
And, yes, though it's a pain, it's probably worth contacting one's bank(s) and credit card companies.

Finally, to be safe, it might not be a bad idea to head over to one of the reputable computer disinfection fora for a free, expert, second-opinion. They can assist with running some scans and other tools, to be sure that there's nothing lurking on the system. (The lack of obvious symptoms does not necessarily mean a computer is clean.)

Good luck,

 

[Layback Bear]

Good point Moxie.
Using another known clean computer to change the passwords ect. is a excellent idea.

 

[cwan]

Thanks to everyone for their sound advice - it is much appreciated.

I'm still a bit confused as to why the scammers wanted to speak with the account holder of the internet service (even though my mother already believed them) and never raised talk of payment with her. I guess I'm concerned about whether scammers ever do this to steal documents/other information for identify fraud or that kind of thing rather than the "pay me $$ to fix your computer" scam which I've read about. If anyone could shed light as to what they were getting at, it would give us both a bit more peace of mind. Ta.

 

[Layback Bear]

The account holder probably has administration privileges. Using that account when accessed by the phone caller anything can be done by the caller.

 

[cwan]

Sounds reasonable, cheers.