Her Bank Account Was Hacked Twice. Another Shop Reloaded Windows, but the Keylogger and Remote Viewer Survived.
An Acworth customer's computer was hacked, her online banking login was stolen and thieves tried to wire $12,000 to themselves. Another company reloaded Windows but kept her files, so the keylogger and remote viewing tool survived, and her new bank account was captured the first time she signed in. The thieves had also changed the recovery email on her Gmail, so the bank's verification codes went to them. A same-day visit wiped the drive, reinstalled Windows clean, took back the email, and reset the bank with new credentials from a clean machine.
“I called Justin and he had availability the same day and came out and resolved the issue on my mother-in-law’s computer. I would highly recommend his service.”
— Mike W. · Google review · Read the full storyHer son-in-law called me in the morning and I was at her house in Acworth that afternoon. By then the family had already been through a bad few weeks. Her computer had been hacked, the people behind it had her online banking login, and they had tried to wire $12,000 out of her account to themselves. The bank caught that one. What nobody had caught yet was how they were still getting in.
The first fix made it look clean. It was not.
After the wire attempt, another IT company had reloaded the computer. That sounds like the right move, and it is the right move when it is done all the way. This one was not. Windows was reinstalled over the top with the old files kept, which is the option that keeps your documents and photos in place. It also kept the two things the thieves had planted: a remote viewing tool that let them watch and control the screen, and a keylogger that recorded everything typed. The desktop looked brand new. The infection was right where it had been.
So she did what the bank told her to do. She closed the old account and opened a new one. The first time she signed in to the new account from that computer, the keylogger sent her new username and password straight to the people she was trying to escape.
They owned her email too
The bank, doing its job, sent a verification code every time someone signed in from a new place. It sent the code to her Gmail. The thieves had already been in that Gmail account and had quietly changed the recovery email address to one of theirs, so they could read every code the bank sent, and they could reset the password any time they liked. Two accounts, a reload, a new bank login, and they still had everything.
Damage control, in the right order
This kind of cleanup only works if the steps happen in the right sequence, because every password typed on an infected computer is a password given away. So the order was:
- The computer first. I pulled the files she actually needed off the machine, then wiped the drive completely and installed Windows fresh, with nothing carried over. No keep-my-files reset. The remote tool and the keylogger went with the old install.
- Then the email. From the clean machine we took the Gmail account back: a new password, the thieves’ recovery address removed and hers put back, every signed-in device kicked out, and a check for forwarding rules and other back doors they leave behind. Her verification codes now go to her phone, not to an inbox.
- Then the bank. With the computer and email clean, we got on the phone with the bank, walked them through what had happened, and got her accounts back up with new credentials set from a machine the thieves could not see.
- Then the rest. New passwords on the other accounts that mattered, and a plain-English rundown for her and her family on what the scam looks like the next time it tries.
If your computer was hacked and a reload did not fix it
- A reload that keeps your files can keep the infection. After a real break-in, the drive needs to be wiped, not refreshed. Your documents get saved off first and put back after.
- Check the email account before anything else. Recovery email, recovery phone, forwarding rules, app passwords and signed-in devices. If the thieves changed any of those, every code and reset lands in their lap.
- Do not sign in to a new bank account from the old computer. That is exactly how the second account was lost here.
- Move verification codes off email. A code sent to your phone or an authenticator app is useless to someone who only has your inbox.
If you or a parent has had money taken, or a bank account that keeps getting broken into after a cleanup, call or text. Same-day visits are the norm for this, because every day the machine stays infected is another day of passwords walking out the door.
Questions people ask
My computer was reloaded but the hacker still got in. How?
A reinstall that keeps your files keeps whatever was hiding in them, including keyloggers and remote access tools. After a real break-in the drive has to be wiped completely, with your documents saved off first.
How did they get the bank's verification codes?
The codes went to her email, and the thieves had already changed the recovery address on that email account to one of theirs. Whoever controls the inbox gets every code and every password reset.
What is the right order to clean up after a bank account is hacked?
Wipe and reinstall the computer first, then recover the email account from the clean machine, then contact the bank and set new credentials. Changing passwords on an infected computer just hands over the new ones.
Should verification codes go to email or phone?
Phone or an authenticator app. A code sent to a compromised inbox protects nothing, and email is usually the first account thieves take over.