My computer has been hacked my screen shows in big letters WINDOWS UPDATE DO NOT TURN OFF hackers get into my credit cards

Disconnect the Windows 11 PC from the internet immediately, contact each card issuer’s fraud department, and do not use that PC for banking or password changes until it has been scanned and secured.

1. Protect your money first

Using a different trusted device or telephone:

1. Call the number printed on the back of each affected card—not any number shown on the computer.
2. Tell the fraud department that the card information is compromised.
3. Ask them to:
   • Block or replace the card.
   • Stop any fraudulent transactions that are still pending, if possible.
   • Open a dispute case for every unauthorized charge that has already posted.
4. Review recent bank and card activity for additional transactions.

Microsoft specifically advises contacting the bank or payment provider to prevent further charges, not merely disputing existing ones ^1^. If charges attributed to Microsoft do not appear in your Microsoft account, the card issuer’s dispute process is the appropriate route ^2^.

If personal identity information was also exposed, contact the relevant identity-theft reporting and credit-reporting organizations in your country. In the United States, Microsoft recommends documenting events, reporting identity theft, and placing a fraud alert with a credit bureau ^3^.

2. Stop the remote connection

1. Unplug the Ethernet cable and turn off Wi-Fi. If the cursor cannot be controlled, turn off the router temporarily or hold the PC’s power button until it shuts down.
2. Do not call any telephone number displayed on the screen and do not permit anyone claiming to be Microsoft to reconnect.
3. If the message is only a full-screen browser page, try Alt+F4. Microsoft notes that scam pages can imitate a locked computer; if the browser cannot be closed, restart the PC ^4^.
4. After restarting while disconnected, open Settings → Apps → Installed apps. Remove unfamiliar remote-control applications, particularly anything installed around the time the incidents began. Examples commonly used during scams include AnyDesk and TeamViewer.
5. Do not assume the large “WINDOWS UPDATE DO NOT TURN OFF” message proves that Windows Update is running. Remote cursor movement means the system should be treated as potentially compromised.

3. Scan Windows before using it normally

Reconnect only briefly if Windows Security needs trusted Microsoft security updates, then disconnect again before the offline scan.

1. Save any open files.
2. Open Start → Windows Security.
3. Select Virus & threat protection → Scan options.
4. Select Microsoft Defender Antivirus (offline scan) → Scan now.
5. The computer will restart and scan outside normal Windows, making persistent malware more difficult to hide.
6. After Windows restarts, open Windows Security → Protection history and review the result ^5^.
7. Then run Virus & threat protection → Scan options → Full scan → Scan now.

4. Secure accounts from a clean device

After isolating and scanning the PC—or immediately from another trusted device:

• Change passwords for email, banking, card, shopping, and Microsoft accounts. Use a different password for every account.
• Enable multifactor authentication wherever available.
• For the Microsoft account, open Security basics → Review activity. Mark unfamiliar activity as This wasn’t me or choose Secure your account, then change the password ^6^.
• Check email forwarding rules, connected accounts, recovery addresses, and telephone numbers for unauthorized changes.

5. If remote control or suspicious screens return

Do not continue using the installation for financial activity. Back up only personal documents and photos—not programs or unknown downloads—then perform a clean Windows installation.

A clean installation removes personal files, applications, settings, and manufacturer customizations, so back up essential files first. Microsoft identifies reinstalling Windows from installation media as an option when malware is suspected and other measures have not resolved the problem ^7^.

After reinstalling, fully update Windows before restoring files, reinstall applications only from their official publishers, and change passwords again if any were entered while the compromise may still have been active.

References

1. How to investigate a billing charge from Microsoft | Microsoft Support
2. Fraudulent Charges on my account - Microsoft Q&A
3. Protecting yourself from identity theft online | Microsoft Support
4. Protect yourself from online scams and attacks | Microsoft Support
5. Virus and Threat Protection in the Windows Security App | Microsoft Support
6. What happens if there's an unusual sign-in to your account | Microsoft Support
7. Recovery options in Windows | Microsoft Support