Security teams detect Screen Sharing Scam by spotting requests to share a screen during sensitive actions, especially when the caller or chat partner pressures the victim to reveal codes, approve transfers or bypass checks. They should flag unusual session initiation, suspicious urgency and repeated requests for visibility into authentication or payment flows.
What security teams are actually looking for
Screen Sharing Scam detection starts with recognising that the scam is usually not about the screen share itself, but about what the criminal wants visible while the victim is being coached through a sensitive action. The signal is a request to initiate visibility at the exact moment a code, payment approval, login prompt, or account recovery step is underway.
Teams should treat the request as suspicious when it appears alongside urgency, authority pressure, or repeated prompts to expose one-time passwords, bank screens, approval dialogs, or support workflows. That pattern is often more useful than any single phrase, because scammers adapt their wording while keeping the same behavioural sequence.
In practice, the most reliable detection comes from correlating the conversation context with the action being taken. A screen share request during a routine meeting is different from a screen share request during password reset, transfer confirmation, remote support, or MFA enrolment.
Where the scam pattern shows up in channels and flows
Screen Sharing Scam attempts often surface in collaboration platforms, remote support chats, voice calls with chat follow-up, and payment or account recovery journeys. That is why the surrounding channel matters: the attack path usually combines social engineering with a trusted workflow, not just an isolated message.
Security teams should look for unusual session initiation, unexpected guest participation, repeated screen sharing prompts after a refusal, and links between the conversation and a high-risk transaction or authentication event. If the same user is being steered from conversation into a transfer, code disclosure, or support action, the risk rises quickly.
Detection also improves when teams monitor for abuse of collaboration tooling itself, including external access, message phishing, and meeting or chat requests that appear to be support-related but are actually designed to build trust and visibility. NHIMG’s Collaboration Tool Security Guide is useful here because it covers the platform behaviours that often carry the scam.
How to separate noise from a likely scam
Not every screen share request is malicious, so the useful test is whether the request meaningfully changes what the other party can see at a sensitive moment. A genuine support interaction usually has a clear service context, a known identity, and an expected workflow. A scam tends to add pressure, secrecy, or urgency around actions the victim should not be guided through live.
One practical indicator is repeated effort to gain visibility into authentication or payment flows after normal verification should already be complete. Another is a mismatch between the stated reason for the call and the requested visibility, such as asking for screen access while claiming to troubleshoot an unrelated issue. Teams should also treat abrupt escalation from conversation to action as a warning sign, especially when the caller pushes the victim to ignore internal checks.
For payment-fraud environments, the scam often behaves like a coached customer event, so a broader scam-fraud lens helps. The Authorised Push Payment (APP) Fraud Guide covers the payment-stage patterns that often overlap with screen sharing abuse.
Risk and Threat Considerations
Screen sharing turns a social engineering attempt into a real-time control bypass when the victim is guided through codes, approvals, or payment steps while the attacker watches. The risk is not just observation, it is coached execution, where the scammer uses live visibility to defeat user hesitation and make the victim validate the fraudulent action for them.
Failure mechanism: The attacker times the screen share request to the exact moment a sensitive credential, approval, or transfer is about to be exposed, then uses urgency and authority cues to keep the victim focused on the wrong decision.
Impact: Teams can miss the scam until after the transfer, account change, or authentication event has already been completed, which makes response slower and recovery harder.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | Screen-sharing scams abuse live remote visibility during sensitive actions. |
| Recommendation — Map suspicious remote visibility events to T1021 and alert on coached user sessions. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Scams commonly enter through messaging, links, and browser-mediated support flows. |
| Recommendation — Harden user-facing channels and block common scam delivery paths. | ||
| NIST CSF 2.0 | DE.AE-03 — Event anomalies are analyzed to understand attack targets and methods | The question is about detecting anomalous scam behaviour in real time. |
| Recommendation — Correlate conversation and transaction anomalies to identify likely scam activity. | ||
Practitioner Guidance
What to verify: Confirm whether the screen share request appeared before or during a sensitive action, not after it. If the request is tied to login, payment, or recovery steps, treat the conversation as a potential scam workflow rather than a normal support interaction.
What to prioritise: Focus detection logic on the combination of urgency, visibility requests, and repeated prompts to reveal codes or approvals. Single-channel alerts are often weak; the stronger signal is the sequence of conversation plus high-risk user action.
Practitioner takeaway: The best detection strategy is behavioural, not keyword-based: look for screen sharing requests that are used to steer a victim through a sensitive transaction, because that is where the scam gains leverage.