You are correct.
You need to contact the bank to inform them of the scam and look to change passwords etc. for the bank account. If he had access to the computer to make contact with the bank he could have taken all sign-in details.
The safest option will be to completely wipe the computer and install Windows 10 clean and then change sign-in password's for all accounts.