If you let someone connect to your computer or phone: if they may still be connected, switch it off or disconnect it from the internet until you can deal with it. Get help only from a person or a company you chose yourself and knew before this happened. Do not take help from anyone who phoned you, wrote to you or popped up on your screen to offer it. Change your passwords and turn on two-step login, using a different device. If you have no other device, ask the person you chose before you sign in to anything. On the one they connected to, update the security software it already has, run a scan and delete anything it finds. Do not sign in or bank on it until the person you chose has checked it.
If you paid by card or from your bank account, or gave a card or bank detail: contact your bank or card company straight away. Use the number on the back of your card or on a statement, or their own app or website. Type the website address yourself. Never use a number that a caller or a message gave you. Ask them to refund your money.
If you gave a password or a login code: make a new, strong password for that account, and change it anywhere else you used the same one. Sign out of all other devices, if the account offers it. Turn on two-step login. Check that the recovery email and phone number on the account are your own. If you can no longer get in, use the company's own recovery steps, in its own app or at a website address you type yourself. Never call a support number you find in a search.
Two things never to do: move or transfer your money to "protect it", or pay anyone up front to get your money back.
These steps are based on the Federal Trade Commission's advice. Some parts are our own advice, such as typing a website address yourself and never calling a support number you find in a search.
PHP has updates that fix two flaws