1
Routine
Invites, recordings and chat notices arrive all day, so one more seems normal.
How it showed up here"You have been invited to a meeting".
Zoom, Google Meet, Teams & Slack Scams
This short course is required for everyone at Charitybuzz. It takes about ten minutes: a few focused lessons, a quick quiz, and a confirmation that goes on your training record. Everything in it comes from the kinds of messages and requests our team is actually receiving, so what you learn here is what you will use at work.
What this covers How attackers abuse meeting and chat tools — fake invites, fake updates and fake colleagues — and how to join and chat safely.
What this is about
We live in video calls and chat. That makes meeting invitations, recordings and "someone messaged you" notices completely routine, and attackers copy them.
Typical tricks: a fake meeting invite that sends you to a sign-in page, a prompt to "update Zoom" or "install a plugin" that is really malware, a shared recording or transcript link, and messages from a colleague's hijacked chat account asking for a favor. In Slack, a name you recognize is not proof of who is writing.
Spot the signs
Quick check: for each item, decide whether it is a red flag or looks fine. Real Google Meet links look like meet.google.com/abc-defg-hij, and real Zoom links are on zoom.us or zoom.com.
0 of 6 answered
https://meet.google.com/abc-defg-hijThis is the real Google Meet address format.
https://meet-google.com.join-session.net/abc-defg-hijThe real owner is join-session.net. Google's name is only a decoration at the front.
https://zoom-us-meeting.com/j/123456789A look-alike. Real Zoom meeting links are on zoom.us or zoom.com.
A pop-up during a meeting invite: "Your Zoom is out of date. Download the update to join"Update through the app itself or the official site, never through a prompt on a page you were sent to.
A meeting invite from a colleague that appears in your Google Calendar and you expected itIt is internal, expected and in your own calendar.
A Slack DM from a coworker's account saying "Are you free? I need a quick favor" followed by a link or gift cardsTheir account may have been taken over. Confirm in a different way, such as a call or another channel.
Why this works on smart people
2
Fear of missing out
You do not want to miss a call or look unprepared.
How it showed up here"Meeting starts in 5 minutes. Join now".
3
Trust in colleagues
A message in Slack from a known name feels safe.
How it showed up hereA real, but hijacked, account sending a link.
4
Software updates
We are used to being asked to update apps.
How it showed up here"Install the latest plugin to continue".
How this lands at Charitybuzz
Meeting and chat scams aimed at an auction company look like these:
Everyone
The fake meeting invite
An email invites you to a meeting with a "partner" or "bidder" and asks you to sign in to your Google account to join.
The tell
You were not expecting it, the sender is outside Charitybuzz, and joining a real Meet or Zoom call never needs you to sign in to a different page.The right move
Do not click. Ask the person through a known channel whether they invited you.Everyone
The "update your app" prompt
A page opened from an invite says you must install an update or plugin to join and offers a download.
The tell
A real meeting app updates inside the app, not from a page you were sent to.The right move
Close the page. Use the official app or site to update, and tell John if you downloaded anything.Everyone
A hijacked colleague account
A Slack or Teams message from someone you know asks for gift cards, a code, or to click a link.
The tell
Their style is off, the request is odd, and there is urgency.The right move
Reach the person another way, such as by phone, before doing anything. Tell John so the account can be checked.Red flags to watch for
A meeting link not on meet.google.com, zoom.us or teams.microsoft.com
Check the owner of the address before the first "/".
A request to sign in to join
A real invite lets you join from the app or with your signed-in account.
An "update required" download
Do not install from a page you were sent to.
An invite you were not expecting
Especially from outside Charitybuzz.
A shared recording or transcript you did not ask for
Be careful with links and sign-in pages.
A colleague asking for money, gift cards or codes
Their account may be compromised.
Urgency to join right now
Pressure to skip checks.
The External label on a meeting invite
The sender is outside Charitybuzz.
A real meeting or chat message
- Matches a meeting you expected
- Appears in your own calendar or app
- Joins from the real Meet or Zoom address
- Never asks you to install a plugin from a page
- Comes from a colleague who confirms it another way
A fake one
- Arrives unexpectedly, often from outside
- Sends you to a sign-in page to join
- Pushes a download or update
- Uses a look-alike address
- Asks for money, codes or favors
What to do instead
Join from your calendar or the app
Use the event in Google Calendar, or open the Meet or Zoom app yourself.
Check the address
The owner of the address should be google.com, zoom.us or zoom.com, or microsoft.com.
Update the app from the app itself
Never download an update from a page you were sent to.
Confirm odd chat messages another way
Phone the colleague, or message them in a different channel.
Report it
Use Gmail's Report phishing and tell John, including for chat messages.
If you clicked — or entered something
Signed in on a page to "join"? Change your password right away
Do it from myaccount.google.com and review Your devices.
Installed an "update"? Stop using the device and call John
It may be malware. Disconnect from Wi-Fi if you can.
Sent gift cards or money to a chat "colleague"? Tell John and Finance immediately
Contact the gift-card company or bank straight away.
Report it — even if you think you got away with it
In Gmail, open the message, click the ⋮ menu and choose Report phishing. Then email [email protected] with a one-line summary of what you did (clicked, opened a file, typed a password, approved a prompt). Fast reports let IT block the sender for everyone.
Typed your password? Change it now
From a device you trust, go to myaccount.google.com by typing it yourself, change your password, and review Security → Your devices. If you reuse that password anywhere else, change it there too.
Approved a sign-in prompt or read out a code? Call IT immediately
This is the most urgent case: the attacker may already be in your account. Contact Charitybuzz IT ([email protected]) right away so they can end every session and reset access.
Opened an attachment or installed something? Stop and tell IT
Don't keep working on that device and don't try to "clean it up" yourself. Leave it on, disconnect it from Wi‑Fi if you can, and contact IT.
Key takeaways
- Join meetings from your calendar or the app, not from a surprise link.
- A real meeting never needs you to sign in on a different page to join.
- Never install an "update" from a page you were sent to.
- A known name in chat is not proof. Confirm odd requests another way.
- Report fake invites and hijacked accounts to John.
Knowledge check
Confirm your training record
This creates the completion record Charitybuzz keeps for compliance. Please use your work details.
Training complete
Your completion has been recorded. Thank you for helping keep Charitybuzz, our nonprofit partners, and our bidders safe.
Certificate ID: —
View & print certificateKeep this handy
- Join meetings from your calendar or the app, not from a surprise link.
- A real meeting never needs you to sign in on a different page to join.
- Never install an "update" from a page you were sent to.
- A known name in chat is not proof. Confirm odd requests another way.
- Report fake invites and hijacked accounts to John.