Staying safe

• Take help only from people you chose to contact yourself.
• Nobody from a bank, the police or a software company needs to connect to your computer to "fix" or "protect" your money.
• Do not tell anyone a password, OTP, PIN or code by phone, chat or e-mail.
• Your RFDesk ID is not a secret. Your RFDesk password is: with the ID and the password, a person can ask to connect.
• Never give your unattended-access password to someone who contacted you unexpectedly. That password lets a person in without anyone approving.

Everything on your screen is visible to the other person while they are connected, including notifications that arrive and passwords as you type them.

• Do not open your bank's website or app, and do not type a password, PIN or OTP, while someone is connected.
• When accepting, choose One app only to show a single window and keep the rest of your screen private.
• Switch Control mouse and keyboard off if the other person only needs to look.
• You can change these while the session runs.

A connection made with the ID and the one-time password is always a request. You see who is asking, and nothing is shared until you press Allow. If you are not expecting it, press Decline. With no answer the request is declined by itself.

The only way in without your approval is unattended access, which is off unless you switch it on yourself on that computer with its own password. See Unattended access.

During a session both sides show the same six-digit security code. If the two codes match, nothing sits between the two devices.

1. On the connecting side, open Connection security in the toolbar (the button reads Secure). The Security code is at the top.
2. On the computer being helped, RFDesk shows the security code with the session.
3. Read the codes to each other, for example over the phone.
4. If they are the same, carry on. If they differ, end the session.

Each device you connect to is remembered by its device key. If the same ID later shows a different key, you are warned before the connection goes any further: "This device's identity has changed".

This happens after RFDesk is reinstalled on that device. It can also mean someone is impersonating it.

1. Do not continue straight away. Nothing has been shared yet.
2. The warning shows the Key you trusted before and the Key it shows now.
3. Ask the person at the device to read you its key from RFDesk there (in the app's settings, under security) and compare it with the new one.
4. If it matches and you know why it changed, choose Trust the new identity and continue.
5. If you are not sure, press Cancel.

• On the computer being helped: press Disconnect in the session panel. The session ends at once.
• On the connecting side: press Disconnect in the toolbar.
• On an Android phone that is being helped: press Stop in RFDesk or in its notification.

If you feel unsafe, disconnect first and think afterwards. Ending a session does not need the other person's agreement.

If a session was misused, either side can report it. In the browser viewer, open Session tools and choose Report this session; the same link is on the page shown after a session ends. The RFDesk app offers Report this session as well.

• Choose what it is about: a scam or trick, access without permission, harassment or threats, illegal content, or something else.
• Describe what happened in a few plain sentences. Do not put passwords or card numbers in the report.
• The report goes to the people who run the RFDesk server, with the session's details: both devices, the times and the network addresses. The screen is not included.
• A session can be reported once from each side, for up to 30 days.