What are the red flags of this scam?

The 'client' contacted you through a professional platform (Realtor.ca, LinkedIn, Indeed) but now communicates only by personal email or WhatsApp • A meeting is arranged via Zoom, Teams, or Google Meet — then mid-call the caller claims audio or video issues and sends an alternate link or asks you to download a file • The alternate link has a URL that doesn't come from zoom.us, teams.microsoft.com, or meet.google.com • The downloaded file is a .exe, .dmg, .zip, or .msi — no legitimate meeting file is an executable • Shortly after clicking the link or opening the file you receive banking notifications about transactions you did not make • The 'client' disappeared or became unreachable immediately after the meeting

What should I do if this happened to me?

Do not click alternate meeting links sent during a call — real video platforms never need you to join a second link mid-meeting • Do not open or run any file a caller sends you during a video meeting, especially executables (.exe, .dmg, .zip, .msi) • If you already clicked or downloaded: disconnect from the internet immediately and contact your bank to freeze your accounts • Change your online banking password and email password from a separate clean device • Run a full antivirus scan; contact your IT professional or cybersecurity support line • If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it. • Report to the Canadian Anti-Fraud Centre at https://antifraudcentre-centreantifraude.ca or call 1-888-495-8501.

HIGH phishing Last reported: Sep 23, 2026 Share

A potential client asks to meet on Zoom — an alternate link or file during the call steals your banking access

Q: Is this a scam?

Yes. This is a documented scam pattern. A fraudster poses as a prospective client on Realtor.ca, LinkedIn, or email. They arrange a Zoom call and mid-meeting claim technical issues — then send an alternate meeting link or a file to download. Clicking grants them remote access or installs a credential stealer; unauthorized bank transactions follow.

A fraudster poses as a prospective client on Realtor.ca, LinkedIn, or email. They arrange a Zoom call and mid-meeting claim technical issues — then send an alternate meeting link or a file to download. Clicking grants them remote access or installs a credential stealer; unauthorized bank transactions follow.

Also known as: Zoom fraud Canada professional, fake client Zoom malware Canada, fake meeting link malware Canada, Realtor.ca scam professional, video call phishing Canada

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.

What to do right now

1 Do not click alternate meeting links sent during a call — real video platforms never need you to join a second link mid-meeting
2 Do not open or run any file a caller sends you during a video meeting, especially executables (.exe, .dmg, .zip, .msi)
3 If you already clicked or downloaded: disconnect from the internet immediately and contact your bank to freeze your accounts
4 Change your online banking password and email password from a separate clean device
5 Run a full antivirus scan; contact your IT professional or cybersecurity support line
6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
7 Report to the Canadian Anti-Fraud Centre at https://antifraudcentre-centreantifraude.ca or call 1-888-495-8501.

Was remote-access software installed?

If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.

Run SeraphSecure to detect and remove it →

Red flags

⚠ The 'client' contacted you through a professional platform (Realtor.ca, LinkedIn, Indeed) but now communicates only by personal email or WhatsApp
⚠ A meeting is arranged via Zoom, Teams, or Google Meet — then mid-call the caller claims audio or video issues and sends an alternate link or asks you to download a file
⚠ The alternate link has a URL that doesn't come from zoom.us, teams.microsoft.com, or meet.google.com
⚠ The downloaded file is a .exe, .dmg, .zip, or .msi — no legitimate meeting file is an executable
⚠ Shortly after clicking the link or opening the file you receive banking notifications about transactions you did not make
⚠ The 'client' disappeared or became unreachable immediately after the meeting

Known variants

AI deepfake voice-call variant: scammer uses real-time voice synthesis to impersonate a known colleague or repeat client. During the meeting the voice sounds familiar — making the alternate link request seem routine. Victim discovers only when the real colleague is contacted afterward.

Last seen: 9/23/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources