Skip to main content
ThreatPhishing & impersonation

Fake Zoom, Webex, or video conferencing account suspended or meeting credential phishing — fraudulent email impersonating Zoom, Webex, or another video conferencing platform claiming the recipient's account has been suspended, their license has expired, or directing them to click a fake meeting invitation link requiring login — directing them to enter credentials, verify their account, or confirm subscription details through a fraudulent portal — a credential-harvesting attack targeting workers who rely on video conferencing for business communications and may click meeting invitations without scrutiny

fake-zoom-webex-meeting-credential-phish

What this tier means

High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.

How Gorganizer detects this

Phishing emails impersonating Zoom, Webex, Microsoft Teams, or other video conferencing platforms — claiming the recipient's account has been suspended, their license has expired, or directing them to a fake meeting invitation link that requires entering login credentials — then harvesting corporate email credentials under the guise of joining a meeting or restoring account access. Video conferencing credential phishing is one of the highest-volume business phishing categories driven by the normalization of remote work. Key facts: (1) Zoom is the most impersonated video conferencing brand in phishing — Zoom's growth from 10M daily meeting participants (pre-2020) to 350M+ (2021–2024) created a massive new phishing target; workers conditioned to click Zoom meeting invitations automatically are prime targets for credential-harvesting fake invites; (2) Fake Zoom meeting links are one of the most reliable corporate credential phishing vectors — workers regularly receive meeting invitations from unknown parties (sales calls, investor meetings, interview calls) making the social engineering context natural and expected; (3) Corporate email credentials harvested through fake Zoom/Webex pages are immediately valuable for BEC attacks: they enable inbox access, forward rules, contact list harvesting, and impersonation of the credential victim to request wire transfers; (4) "License expired" and "account suspended" lures target Zoom Pro and Zoom Business users who pay for the service — the urgency of losing paid features drives immediate action; (5) Legitimate Zoom and Webex meeting invites, account management, and subscription renewals are handled through the authenticated app and official portals — not through email links requiring credential entry on external sites. Warning signs: non-official video conferencing domain (not zoom.us, webex.com, or microsoft.com), meeting invite requiring external credential login, account suspension urgency with external link.

False-positive guard

Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.

About the scoring engine

Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.

Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.

Ready to clean your inbox?

Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.

Get started