Fake Zoom meeting invite phishing: how to tell a real invite from a scam

A meeting invite is one of the few emails people open without thinking: it's expected, it's urgent, and clicking "Join" is the whole point. Attackers know this, so they copy Zoom invitations, "missed meeting" notices and recording links. This guide shows how to tell a real Zoom invite from a fake one, what to do if you clicked or installed something, and what admins should do next.

What is a fake Zoom meeting invite?

A fake Zoom meeting invite is a phishing email made to look like a Zoom invitation or notification. It sends you to one of two places: a fake sign-in page that captures your email password, or a page that claims your Zoom app is out of date and offers a malicious "update". Either way, the attacker gets into your account or your computer.

Microsoft has documented the fake-update version in detail. In March 2026 it described "highly convincing Teams and Zoom phishing emails that mimic legitimate meeting requests", with fake sites showing "update required" prompts that installed remote monitoring and management (RMM) tools such as ScreenConnect, Tactical RMM and Mesh Agent (Microsoft Security Blog). An RMM tool is legitimate remote-support software; in an attacker's hands it's a remote control for your PC. In April 2026 Microsoft described a state-backed group that posed as recruiters, scheduled a "technical interview" and directed targets to download a file called Zoom SDK Update.scpt (Microsoft Security Blog).

Common versions of the lure

The subject lines are chosen to make you click fast: salary, HR, performance reviews, legal matters and job interviews.

Example of a fake Zoom meeting invite

This is an example written for this guide. It is not a real Zoom email.

From: Zoom Meetings <meetings@zoom-us-invite.com>
Subject: HR has invited you to a Zoom meeting: 2027 Compensation Review

Hi,

Human Resources is inviting you to a scheduled Zoom meeting.

Topic: 2027 Compensation Review (Confidential)
Time: Nov 3, 2026 09:30 AM Eastern Time

[ Join Zoom Meeting ]

You will be asked to verify your company email to join.

The giveaways: a sender domain that isn't zoom.us, a topic built to create anxiety, and a note that you must sign in with your company email to join. The button usually leads to a copy of a Microsoft 365 or Google sign-in page, not to Zoom.

How do I know if a Zoom invite is real?

You know a Zoom invite is real when you expected it, it comes from the organizer you know, and its join link goes to Zoom without asking for your email password or a download. If any of those fail, confirm with the organizer through a channel you already use before you click.

What real Zoom email looks like

Zoom says "Zoom account and notification emails originate exclusively from no-reply@zoom.us", and support ticket emails come from customercare@zoom.us (Zoom Support). Most meeting invitations you receive, though, aren't sent by Zoom at all. When a colleague schedules a Zoom meeting from Outlook or Google Calendar, the invitation usually comes from their own address, with the Zoom link inside.

Joining is simple, and that's the strongest test. Zoom's help says you click "the join link below Join Zoom Meeting", may wait in a waiting room until the host admits you, and can "join a meeting without an account". You can also go to join.zoom.us and type the meeting ID (Zoom Support). Nothing in that process needs your Microsoft 365 or Google password.

Real vs fake Zoom invites

Check the link without clicking

On a computer, hover over the button and read the address in the status bar; on a phone, press and hold. A genuine link starts with https:// and a zoom.us host, sometimes with a company subdomain in front. Watch for lookalikes that put "zoom" in a different domain, such as zoom-us-invite.com or zoom.us.meeting-join.com; the real domain is the last part before the first single slash. Our guide on how to check if a link is safe explains how to read a URL, and lookalike domain phishing covers the tricks.

A real Zoom address isn't proof

Anyone can create a Zoom account and schedule meetings or webinars, so an invitation sent through Zoom's own systems can still come from a stranger. Judge the meeting, not just the sender: who organized it, whether you expected it, and what it asks you to do.

Is it safe to download a Zoom update from an invite?

No. Never install Zoom or a Zoom "update" from a link in an email or a meeting page. Install Zoom only from the Zoom Download Center at zoom.us/download, which offers the Zoom Workplace app for Windows, macOS, Linux, iOS and Android (Zoom Support), or from your company's software portal. Update an installed app from inside the app.

Microsoft's advice after the 2026 campaigns was blunt: "Users should never run scripts or commands shared through messages, calls, or chats without prior approval from their IT or security teams", and "always inspect and verify files downloaded from external sources" (Microsoft Security Blog). The same rule stops fake CAPTCHA tricks; see ClickFix fake CAPTCHA emails.

What should I do if I clicked a fake Zoom invite?

If you clicked a fake Zoom invite, what you do next depends on what happened after the click. Act within minutes and tell IT for any work account.

Do this now:

1. If you typed a password, change it immediately from a trusted device, typing the sign-in address yourself. Change it anywhere else you reused it.
2. If you entered a code or approved a sign-in prompt, tell IT now. A fake page can pass your code to the real service in real time; see AiTM phishing and MFA bypass.
3. If you downloaded or ran anything, disconnect the computer from the network (Wi-Fi off, cable out) and call IT. Don't keep using it, and don't try to clean it yourself.
4. If you only opened the page and left, close it and report the email. Opening a page is lower risk than typing into it, but tell IT if you're unsure.
5. Report the email with your mail app's phishing button, then delete it. Our guide to reporting phishing emails covers each app.

The full checklist is in what to do after clicking a phishing link.

Report it to Zoom

Zoom takes reports through its Trust & Safety form at zoom.us/trust-form. Choose Report Abusive Behavior or Content, say where it happened and what happened, add a description and attach evidence if you have it (Zoom Support). Zoom lists Spam, Impersonation and Scam among the report types. Including the meeting link helps Zoom find the account behind it.

What should an admin do about a fake Zoom invite campaign?

An admin should treat a fake Zoom invite as a campaign: block it, remove every copy, check who clicked, and check for remote access tools on any machine where someone downloaded a file.

1. Block the sender domain. In Microsoft 365, open https://security.microsoft.com/tenantAllowBlockList, select Domains & addresses, then Add > Block. Entries default to 30 days, and Microsoft says mail from blocked senders "is marked as high confidence phishing and quarantined" (Microsoft Learn). In PowerShell: New-TenantAllowBlockListItems -ListType Sender -Block -Entries "zoom-us-invite.com" -NoExpiration. In Google Workspace, use the Gmail Blocked senders setting; see block emails by country or TLD for the path.
2. Remove every copy. In Microsoft 365, use Threat Explorer or Real-time detections. In Google Workspace, use the security investigation tool.
3. Clean up calendars. Invites can leave events on calendars even after the email is gone. Our guide to calendar invite phishing shows how to restrict external invitations and remove spam events.
4. Look for unapproved remote access tools. Microsoft recommends application control (WDAC or AppLocker) "to block unapproved IT management tools", searching for unapproved RMM installations, and resetting passwords for the accounts used to install them (Microsoft Security Blog).
5. Secure any account that entered a password. Revoke sessions, reset the password, remove unknown MFA methods and check forwarding. See signs an email account is compromised and malicious inbox rules.
6. Tell staff which meeting tools your company actually uses, and that nobody will ever need a download or their email password to join.

Most of these lures arrive from new lookalike domains, which inbound filtering is good at catching. An MX-level filter in front of Microsoft 365 or Google Workspace checks every inbound message for phishing and spoofing and holds suspect ones in quarantine before staff see them; how iBlockSpam works explains the setup.

Next steps

1. Share the two rules with staff: you never need your email password to join a Zoom meeting, and you never install Zoom from an email.
2. Restrict calendar invitations from unknown senders in Google Workspace or Microsoft 365.
3. Run the free Lookalike Domain Generator on your own domain to see which near-copies could be used to fake your internal invites.
4. If fake invites keep reaching inboxes, see how iBlockSpam filters inbound email before it reaches your users.

Browse our other phishing and threat guides.