Scam library · Email & phishing · Small business
Fake Zoom, Loom or video message phishing
An email says 'Jessica shared a video with you' or 'You have a new Zoom meeting invitation' with a play button. Clicking leads to a page that asks you to sign in with your Microsoft or Google account, or to download an 'update' to view it.
Video messages are common in sales and work, so the email doesn't feel unusual. But the page is fake, and the goal is your work email password or a malware install.
What the message looks like
From: Jessica Moore via Loom <video@loom-share-notify[.]com>
Subject: Jessica sent you a video: 'Quick idea for your team'
Jessica recorded a 2-minute video for you.
[ ▶ Watch video ]
→ Opens a page asking you to sign in with Microsoft to watch.
How this scam works
Scammers send these from hacked accounts of real people, often vendors or contacts, so the name looks familiar. The pages copy Zoom, Microsoft Teams, Loom or similar services.
A version that's grown since 2024 shows a fake meeting page with a broken video or audio error. It asks you to 'fix' the problem by downloading a file or pasting a command into your computer. That installs malware that steals saved passwords.
If you do business online, your email account is valuable: it's where invoices, bank details and password resets live.
Red flags
- A video or meeting link that asks for your email password.
- A page asking you to download a plugin or 'update' to watch or join.
- Instructions to copy and paste a command to fix audio or video.
- A sender who doesn't usually send you videos, or a lookalike domain.
- Vague subjects like 'quick idea' or 'proposal for you'.
How to tell it’s fake
- Check the address bar: real Zoom links go to zoom.us, Loom links to loom.com.
- Ask the sender through another channel whether they sent it.
- Open the Zoom or Teams app directly and join from there.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you didn't enter anything, close the page and report the email to IT.
If you paid
- If you were asked to pay, don't. Verify any payment request by calling a known number.
If you shared personal info, a password or a code
- If you entered your password, change it immediately, sign out of all sessions and turn on multi-factor authentication. If you ran a command or downloaded something, disconnect and get the computer checked.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard runs in Chrome and Edge on your computer. It checks video and meeting invitations you have open in Gmail or Outlook on the web and the pages they open, recognizes fake meeting and video pages, and warns before you type a password or follow 'paste this command' instructions. If a video seems legit, a scam expert can confirm before you click.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Do I need to sign in to watch a Loom video?
- Usually not. Real Loom videos play without your email password.
- A meeting page asked me to paste a command. Is that normal?
- No. That's a malware trick. Close the page and don't run anything.
- I typed my Microsoft 365 password. What now?
- Change it now, sign out all sessions, enable MFA and tell your IT team.