A recruiter asks you to install remote-access software: stop and verify

Understand what remote access can permit

Remote-access software can let another person view a screen, move the pointer, transfer files, run programs or administer a device from elsewhere. The exact permissions vary, but the risk is larger than opening an ordinary webpage or joining a video call.

CISA explains that legitimate remote-access and remote-monitoring tools are increasingly co-opted by malicious actors. That does not make every tool suspicious; it means the identity, purpose and permission must be verified before installation or connection.

Treat recruitment and employee IT support as separate trust steps

A real employer may configure a company laptop after hiring, but an unsolicited recruiter should not need control of your personal computer to explain a vacancy or assess ordinary experience. Be especially cautious when the request arrives before a live interview, from a personal email address or messaging account, or alongside pressure to act immediately.

The FTC warns that fake recruiters can impersonate known employers, send convincing paperwork and seek sensitive financial information before a real interview. Verify the vacancy and recruiter through contact details you find on the organisation's own website; do not use only the number or link in the message.

Verify a remote role before you apply →

Pause before sharing a screen or one-time code

Do not display a password manager, banking page, identity document, private email, customer system or authentication code while another person can view or control the device. A one-time code is a security credential, not an interview detail. Never approve an unexpected sign-in or multi-factor prompt merely because the caller says it is a test.

If a verified employer needs technical support during onboarding, ask for the written IT policy, the official help-desk route, the approved tool and the permissions it will request. Prefer a company-managed device when the role requires broad administrative control.

Review the personal-device and BYOD checklist →Protect the account behind your job search →

If you already allowed access, contain the risk

Disconnect the device from the network and end the remote session. From a different trusted device, change passwords for accounts that may have been visible or used, revoke active sessions and contact the relevant bank or service provider if financial information was exposed. Preserve the message, sender details, software name and transaction evidence before deleting anything.

Seek help from a trusted technical professional or the genuine organisation's security team to remove unapproved software and check the device. Report suspected fraud to the appropriate cybercrime or consumer-protection authority in your country.

Use this remote-access decision check

• Stop if the request came through an unexpected recruiter message or before a verified interview.
• Find the employer's careers page and contact details independently.
• Ask why remote control is necessary and whether a normal video call or written step will work instead.
• Confirm the official IT contact, approved tool, requested permissions and end-of-session process.
• Keep passwords, one-time codes, identity documents and financial accounts off the shared screen.
• Do not disable security controls or pay for software at a recruiter's instruction.
• End the session and contain the device immediately if anything unexpected occurs.

Check whether the role and application route fit →Browse current checked roles →