How to Protect Online Video Calls From Hackers: Settings, Habits and Scams

Key takeaways

• Most meeting problems come from public links, no passcode and no waiting room.
• Fake meeting invites and "update your client" prompts are a common way to deliver malware or steal logins.
• End-to-end encryption exists on several platforms but is often optional and limits some features.
• Hosts should control who can share screens, record and join.
• A familiar face on screen is no longer proof of identity, because deepfakes and voice cloning exist.

How safe are online video calls?

The main platforms encrypt traffic in transit, so most real-world problems come from settings, accounts and people, not from someone breaking the encryption. In 2020 the US National Security Agency published guidance comparing collaboration services, and it noted that no single service met every criterion at that time. Features have changed since, so check each platform's current security documentation, and treat any old comparison as history.

What are the main risks?

• Uninvited guests ("Zoom bombing"). Public or guessable links let strangers join and disrupt.
• Fake meeting invites. Emails or messages with a link to a "meeting" that actually asks you to sign in on a fake page or download a "fix" or client update.
• Account takeover. Stolen passwords give access to meeting history, recordings and contacts.
• Software vulnerabilities. Patches fix bugs that attackers use; see our post on Zoom's patched high-severity vulnerabilities.
• Oversharing. Sharing the wrong window, visible notes or a confidential chat.
• Impersonation. Someone pretends to be a colleague, or uses a cloned voice or face to request money or access.

Checklist for hosts

1. Use unique meeting links and not your personal permanent room for public events.
2. Require a passcode and turn on the waiting room or lobby, then admit people you recognise.
3. Restrict screen sharing to the host, and limit who can record or change settings.
4. Do not post meeting links publicly. Use registration for webinars.
5. Lock the meeting after everyone has joined, if your platform allows.
6. Use end-to-end encryption where offered for sensitive meetings. It may disable features such as cloud recording or live captions, so test first.
7. Use sign-in only and organisation-only access for internal meetings.
8. Tell people when you are recording and store recordings securely.

Checklist for attendees

• Update the app, and turn on automatic updates. Download clients only from official stores or the vendor website.
• Use a unique password and multi-factor authentication on your meeting account.
• Check the invite sender and the link domain before clicking. If unsure, open the app and join with the meeting ID.
• Share a single window, not your whole screen, and close notifications and private tabs first.
• Use a background or blur if you need privacy, and cover the camera when not in use.
• Mute the microphone when you are not speaking.

How do you spot a fake meeting invite?

Warning signs: unexpected invitations, urgency, a sender you do not know, a link that goes to a domain that is not the meeting provider, a request to download software to join, or a login page that appears after clicking. Instead, go to the platform directly and enter the meeting ID. Report suspicious invites to your security team. Indian users can find advice at CERT-In.

What about deepfake impersonation?

Attackers have used cloned voices and manipulated video in scam attempts. For payments, access changes or sensitive data, confirm through a second channel such as a phone call to a known number, and agree on approval steps in advance. See our posts on remote work security and securing social media accounts.

Common mistakes

• Posting a meeting link on social media.
• Skipping the passcode because it is "just a class".
• Clicking a "your client is out of date" pop-up inside a call.
• Assuming encryption means the other participants are who they say they are.

Next steps

Next steps: to learn how organisations secure collaboration tools, see our Cyber Security course, and read about remote work security.