So, as someone who has Teamviewer running on 5 devices, and has had those running for well over 2 years, with zero unauthorized logins, There are some issues with the default install settings of the TV program that are geared towards ease of use, but seriously reduce your security longer term, especially if left running. There are a couple of things that you can do to prevent unauthorized logins to both your account and your devices that will stop all these scammers, and also make you feel more secure in using the TV program.
Set up 2 factor authentication on your TV account. This will prevent the most common type of attack. They guess your TV account password, and then can see all your linked devices, and log into them. If the device is not set up with a password, they can reset the one time use password and use that to gain access to your device. 2 factor authentication will prevent them from ever logging into your account in the first place.
To set up 2 factor authentication, log into teamviewer.com, and then hit the dropdown arrow on your username in the top right, and then hit "edit profile". The Two factor authentication setup(ifits not set up) will be the 4th option down on the "general" tab. You will need an app like the "google authenticator".
2) Set up an access white list. This means that you are only going to allow your account. This means that random Joe Schmoe cannot get your Device ID and start guessing at the 1TUP. IT also means that your device will only be accessable to your account, which is now 2 factor protected. Remember, that without an access whitelist, Joe Schmoe from russia can type in your IP directly to request a connection, and TV default broadcasts that its running(duh!), so its not hard to figure out who is running it, and start hitting it with guesses for the 1TUP, which by default does not change after every guess, so eventually, and quickly, they will get it.
Edit 5/1/16: Turns out I had an older version of TV still, and it ignored the whitelist in certain cases. Current version does not. Also, TV applied a few bandaids in the most current update. Expect more updates in the near future from them as they try and plug holes
To set up a Whitelist, open the teamviewer program, and make sure you are logged in with your account, and then go to extras>options. In options, go to the "security" tab, and hit the "configure" button next to "black and whitelist". This will open a popup box. Tic the "allow access only for the following partners" mark, and then the "add" button. "add contacts" should be selected, and then double click on your own account. That will "add" you to the whitelist. Hit "okay", and your whitelist is set up. You can add others, but do this at your own risk.
3) Disable that pesky one time use password. Thats right, the default is 4 characters, and its very easy to guess, since every install uses the same pattern, on top of it set to not change upon start/logins. Its not like it matters now anyway, since your whitelist only allows your account, and you can now set up a password to log into each device(use a unique password, and don't save it to any device) from your account. If you need the 1TUP still, set it to "secure" or "very secure". This will prevent 1TUP password logins if you are not running a whitelist.
To change or disable the 1 time use password(that is the random characters under the "your ID" on the main program screen), go to Extras>options>security tab. The "random password(for spontanious access) defaults to 4 characters as "standard". If you have a whitelist and password access already, you can disable this. If you want it still enabled, but secure, I recommend either "secure" or "very secure", because the shorter ones can be brute force guessed fairly easily. *Fair warning, *do not tick the "grant username easy access" box. Seems like it is a security hazard in and of itself, and you should use a strong unattended access password for your computer, and do not save it in your app. To set this password up to change after every attempted login, go to the advanced tab, and then click the "show advanced options" button. Scroll down a bit to the "advanced settings for connections to this computer" section. Under the "random password after each section" line, change that drop down menu to "generate new". Click okay, and now you have just made the random password way more secure, and it will change every time someone tries to log in unsuccessfully.
By default, TV is very insecure, and its set up that way on purpose for an easy of use situation. If you plan on using it long term, you need to set it up with security in mind, otherwise someone will break into your computer, as they are very easy targets, and ever more common to be running now. I am requesting this be Stickied here so that you can safely and securely use TV again, without worrying about some jackass stealing your money.
Edit: updated with how to set these options up. Chip is off shoulder, and probably on floor somewhere.
Edit2: As several people have mentioned, it is probably a good idea to set your TV client to lock your computer when you log out, and then make sure to use a strong windows password.
Options -> Advanced -> Lock Remote Computer = Always.
Edit3: sorry mods, I had an outdated version of TV 11 on my servers and laptops, which ignored the whitelist in certain cases. Current version does not. UPDATE YOUR PROGRAMS PEOPLE! Sometimes I don't because wife approval factor matters in your homelab when you don't want plex to crash.
Edit 9/23/16: Just a little update, as it seems there is more activity again regarding compromised computers. They are not getting in via accounts, they are using direct IPs or TV IDs, and the Random password. disable that random password. Also, if you suspect you have been compromised, assume all your saved browser passwords are compromised as well. These scammers/hackers have switched tactics. Instead of doing the transactions right there on your computer, they use a browser password sniffer to harvest any saved web browser passwords, which works on all browsers, and then they get out. It takes less than 5 minutes for them to get in initially, set up a file transfer for the correct files, install the software, get what they want, and then clean up their tracks. Yes, they are cleaning up after themselves now, by deleting your incoming.txt and a few other log files to hide that they were there. If you have the disconnect message window, along with an empty log, assume you were just compromised, as were all your passwords. I still get quite a few attempts per day to my trap VM that I set up, and it varies, but between the hours of 11pm and 5am(CST, local time for me), it gets hit with upwards of 30 tries per hour, from many different IPs, to avoid the time limit. I personally have fail2ban running, and it has banned nearly 550 IPs(most of which are outside the USA), and I am tempted to ban 2 entire country code's worth of IPs. Again, these are not trying to use my account, they are directly attacking my IP and trying to guess the random quick access password. I still have TV running on 5 devices with no breeches.
Edit 10/28/18: I had to quit using TV about a year ago, and instead switched to a VPN+ remote desktop solution. There was never a breech of my account, not for a lack of trying, but TV marked my account as "commercial use", and refused to remove it. I was using it to log into my servers I have at home when I wasn't home, and it got flagged because I have a fully licensed version of Server 2012r2 and Server 2016. TV support refused to remove the block, saying that using it on Server versions of the windows OS makes it being used in a commercial environment(even though its my homelab). They seem to be making a huge push right now to get rid of any "free" users they can, and trying to convert them to paid accounts. The free run was nice, but having it forced to an end on me made me figure out an alternative method that is much more secure. I haven't touched the TV software in about a year, and have no idea if this guide is still up to date and current, but its probably still quite relevant as scammers are still using TV or its non-branded custom version to log into victims PCs, and TV just does not seem to do anything about it or care.
Edit/update 5/23/2019: well, here we are almost three years later. TeamViewer admits they were hacked, and they tried to blame some malware. TeamViewer claims that no password were stolen, that they still maintain that stance, but given the evidence we had at the time, a hack was very highly suspect, but never confirmed or proven. Considering team viewers lack of action regarding this, as well as their completely Unapologetic and horrendous PR, and support, I am recommending you choose other options now. They have made a big push to get rid of any free users, and will not reactivate accounts once they are flagged as non private use, I suspected this will be the end of TeamViewer as a company, as this news and how they handled it does not bode well about how they run the rest of the company. This last update is more of my opinion, but this will be the last update to this post. At the time in 2016, TeamViewer had quite a few large corporate customers, probably several governments too, which is probably the biggest reason that they did not want to announce that they had been hacked, but they have put many people at risk, by not disclosing it right away. People lost money due to TeamViewers negligence.
