Report abuse
If someone telephoned you and asked you to install this
Stop, and disconnect the computer from the internet. No bank, no government department, no software company and nobody from Nelkira Technology Ltd. will telephone you unprompted and ask you to install remote desktop software or read out a nine-digit number. That call is a fraud, whoever the caller says they are.
- Close Nelkira, or turn the computer off if you are not sure how.
- If they saw your online banking, or you moved any money, telephone your bank now, on the number printed on your card.
- Report it to the police where you live.
- Change the passwords for anything you signed into while they were watching, from a different device.
- Have the computer checked before you use it for anything sensitive again.
Then tell us at abuse@nelkira.com. Your bank and the police can act faster than we can, so please do those first.
Why we cannot simply look
We should be straight about the limits of what we can do, because other companies are sometimes not. Nelkira sessions are encrypted between the two computers. Where a session went through a relay we operate, that relay carried bytes it could not read. So we cannot replay what happened to you, and we cannot tell you what the other person did or saw.
What we can do is look at connection records — which machine numbers connected, when, and from which network address — for the 30 days we keep them, act against the machines and networks involved, and give what we hold to the police or your bank when they ask through the proper channel. That is often enough to be useful in an investigation, so it is worth reporting even when it feels too late.
The record of what was actually done during the session is on your own computer. It is under C:\ProgramData\Nelkira\audit on Windows, and it will show when the session started, how long it lasted, and any files that were taken or placed. Keep it: it is evidence, and it is yours.
What to send us
Whatever you have. None of it is required, and a short message is better than none:
- the nine-digit number of the machine that connected to you, if you saw it;
- your own machine number;
- the date and rough time, and your time zone;
- the audit file mentioned above, if you can find it;
- what the caller said, what number they rang from, and what they asked you to do.
Other things to report
The same address takes reports of anything else in breach of our Acceptable Use Policy: remote access installed on a machine without the owner being told, someone keeping access after permission was withdrawn, monitoring of a person rather than support of a computer, or misuse of a relay we operate.
Law enforcement
Officers with a lawful request should write to legal@nelkira.com from an official address, with the legal basis and the period of interest. We answer valid requests, we ask for the narrowest data that answers the question, and where we are permitted to tell the customer, we do. Please note the 30-day retention: a request that arrives late will find nothing, so send a preservation request early if you need one.
For the organisations we supply
If you support other people’s computers, the single most effective thing you can do about all of this is to tell your users plainly, in advance: “we will never ring you out of the blue and ask for your Nelkira number.” Nearly every incident involving software of this kind begins with that telephone call, not with anything technical.