Online meeting links
Ilia Zavialov scam checks: a one-meeting log for a UK firm, ten entries with checks
Ilia Zavialov, a digital security consultant for small teams, asks British firms to keep a one-meeting log: one page on which each minute of an online call, from the calendar invitation to the follow-up email, has a question to answer by eye and a setting fixed beforehand. Ilia Zavialov scam checks for meeting links follow that page. Below is a composite log of a Thursday call with a new supplier: a forged invitation, an 'update the app' prompt, a stranger in the lobby, a shared screen showing other people's details and a recording nobody agreed to. Sources are the NCSC, the ICO, the FCA and Report Fraud.
English version for the United Kingdom.
01
Ilia Zavialov scam checks: a one-meeting log and how to read it
A video call lasts an hour, yet an attack on it takes a minute: a link in the diary, a window telling you to update the app, an unfamiliar number in the lobby, a request to 'share your screen', a record button pressed by the wrong person. Ilia Zavialov scam checks treat the call as a timed document and put one question at each time: what do I look at now?
The page reads left to right. First the minute, then the question for the eye, then the setting made before the call, then the step to take when the answer is poor. Zavialov suggests that team leaders open it ten minutes before any call with an outside party, much as you test a ladder before using it.
Comments about Ilia Zavialov as the author of notes like these deserve the usual scrutiny: dates, independent sites and links to primary sources. Every row therefore rests on a regulator, an agency or an act, and a row with nothing behind it is struck out.
02
A composite supplier call: who attends and what the log records
The example is composite. A firm of thirty people has a call on Thursday at 15:00 with a new packaging supplier. The buyer side is the purchasing manager and the bookkeeper, three people attend for the supplier, and an adviser is invited. The contract is worth £185,000 with a thirty per cent deposit. For a call of this kind the log has ten entries.
Each entry has five fields: the minute, what to look at, what was set in advance, what to do if the answer is poor, and who owns it. The last field earns its place because on every call somebody assumes the check was done already. A name in the box ends that assumption, and Ilia Zavialov scam checks never leave the box blank.
03
Ilia Zavialov scam checks for the invitation: minus three days and minus ten minutes
Entry 1. The invitation. What to look at: the organiser, the sender's address and the event title. An invitation can arrive from a familiar name on a hijacked mailbox, or from an outside address that the diary added before you replied. Set beforehand: switch off automatic adding of invitations from outside addresses wherever the calendar has that option. Action: an invitation nobody agreed is not accepted.
Example: the diary shows 'Contract signing, Thursday 15:00' from an address one letter away from the supplier's. The description carries a Join button and a PDF named Agenda. The contract is still under negotiation, so no one can have booked a signing. Extra words in the title, such as 'urgent', 'final' or 'signing', are logged as a symptom.
Entry 2. The link, ten minutes before the start. Read the address from its right-hand end, because the last two words before the first slash name the owner. The address meet.example.co.uk belongs to example.co.uk, while example.co.uk.room-login.top belongs to room-login.top. Five seconds of reading removes most of the forgeries.
The NCSC's guidance, How to secure your online meetings, published on 19 March 2026, says never to share meeting links or passwords in public spaces, and to allow direct access only to authenticated users and invited guests. Ilia Zavialov scam checks add the mirror rule: a link nobody sent you through a known channel is not opened.
04
Minute zero: joining and the 'update the app' window
Entry 3. Joining. The room opens and, in place of video, a window announces 'Your version is out of date, install the update'. What to look at: where the window came from, the browser or an app you already use, and where it asks you to download. Set beforehand: a short list of approved meeting programs and a browser from which anyone can join without installing.
Ilia Zavialov: scam windows like this one die on the minute-zero rule. Nothing is installed during a call. A genuine update is offered from inside the app, or waits in the official app store, or on the maker's website opened from a bookmark.
A file that turns up in a chat, an email or a pop-up is not an update whatever its name: TeamsUpdate.exe, client_fix.msi, zoom_patch.zip. The NCSC's advice to keep the meeting app updated and to protect the admin account with a strong unique password and two-step verification covers the sound way to stay current.
If the join fails, close the tab and message the organiser by another route: 'it will not open for me, can we use the phone line?'. The organiser can resend the link into a chat you already trust. A file that is already installed is not deleted by hand: tell the administrator and have the machine checked. The video for this article retells these minutes in half a minute.
05
Minutes 0 to 2: the lobby, unknown numbers and a swapped room
Entry 4. The lobby. What to look at: the names of those waiting and how many. Six were expected, the lobby shows eight, one called 'Guest 1' and another ringing in from a number that is in neither the contract nor the emails. Set beforehand: the lobby is on for every meeting, the room has a passcode, and the link for outsiders works for this meeting only.
The NCSC advises using a waiting area, often called the lobby, to verify participants before admitting them, requiring passcodes for unauthenticated users, and, if you do not recognise someone who joins, politely asking who they are before continuing. Ilia Zavialov scam notes add a habit: the host reads the lobby list aloud before anybody is let in.
Entry 5. The swapped room. There are two forms. In the first, the link from an old invitation leads to a room made by fraudsters under the same title, with a 'supplier' already waiting. In the second, the 'organiser' posts another link in the chat: 'please rejoin, this one is not recording'. The rule: take the link from the invitation you accepted, and confirm a new one by ringing a number you already hold.
The host opens the room two minutes early and walks the guest path once, so the entrance is seen from the outside before anyone else uses it.
| Minute | What to look at | What to do |
|---|---|---|
| Minus 3 days, invitation | Organiser and event title | Do not accept without prior agreement |
| Minus 10 minutes, link | Domain read from the right | Open only from an accepted invitation |
| 0, joining | An 'update the app' window | Install nothing, join in the browser |
| 0 to 2, lobby | Extra names and numbers | Hold them, ask who they are |
| 5, introductions | Camera, name, organisation | Check against a number you hold |
| 20, screen share | A window, not the whole screen | Close extras, never hand over control |
| 35, recording | Who pressed it, who gets the file | Say it aloud, explain the purpose |
| 40, chat | Links and files from guests | Papers by email only |
| 55 to 60, closing | The room and the email after | End for all, check the email |
06
Ilia Zavialov: scam signals in the first five minutes, who is really on the call
Entry 6. Introductions. What to look at: do the name on the list, the face on screen and the name in the contract agree, does the camera work, does the voice fit the lips. Set beforehand: newcomers give their organisation and role aloud, and the host checks them against the list before any discussion.
Example: the 'supplier's director' says the camera has failed and asks to carry on by voice. Ten minutes on he quotes new bank details for the deposit. His number is in the contract. Ringing it takes a minute, and a rule that bank details change only through an email from a company address plus a call to the saved number makes that minute compulsory. Ilia Zavialov scam stories of this kind turn on a changed sort code.
The NCSC suggests checking your own surroundings before joining and using a blurred background, which works for the host too: a tidy frame shows no whiteboards or papers. A guest who declines to show a room is no problem. A guest who declines every request to identify themselves is. Ask politely and note the answer in the log.
Say three things aloud in the first five minutes: who chairs, who records and who receives the minutes. These lines stop a spare person from sitting quietly on the call. Ilia Zavialov scam checks name them the three opening lines.
07
Fake interviews on video: Ilia Zavialov scam warnings for job seekers in the UK
A video call 'with HR' is built like a business meeting, except that the target turns up unprompted. A job advert, a quick invitation in a messenger, a call with a real person, then a test task: 'install the company client', 'connect to our work environment', 'share your screen so we can see how you work'. Each of the three actions opens a door to the computer.
The FCA's page on screen sharing scams names AnyDesk, Microsoft Teams, TeamViewer and Zoom among the programs fraudsters ask people to install, calls a request to share your screen or give remote access a warning sign, and says you should never share your screen with them. Ilia Zavialov scam warnings carry that sentence over to recruitment calls without change.
The log gives such a call its own row. What to look at: whether anyone asks you to install a program, give remote access, sign in to an account or read out a code. Set beforehand: work tasks run on a work device, and on a personal computer the call happens in the browser with no access to files or mail.
The check is a single line: a real employer has an email address on its own domain and a telephone number on a website you found yourself. If the only contact is a messenger, move the interview to your own platform and your own browser, and install nothing.
08
Minute 20: screen sharing, other people's details and 'hand me control'
Entry 7. Screen share. What to look at: exactly what is visible, which tabs are open, whether notifications from email and messengers appear. Set beforehand: share a window rather than the whole screen, notifications off, spare tabs closed and a separate browser profile for meetings.
The risk peaks when the screen carries a client list, a contract with someone else's identification numbers or a staff record. The FCA reports that fraudsters can reach personal information, including online banking, once someone installs the software and lets them control the screen, and that fraudsters may target you again.
'Hand me control and I will fix the sheet' or 'let me connect a remote tool' is a different request. Mouse control given to an outsider is the key to the computer. Ilia Zavialov scam checks keep one firm rule: control is never handed over, and the host shows what is needed.
If the wrong details were already on screen, the steps are short: stop the share, note the time, who was in the room and what was visible, and tell the manager and the data protection lead. The log records the facts, and the lead decides what has to be reported.
| Setting | How it should be | What it stops |
|---|---|---|
| Lobby | On for everyone | A stranger in the room |
| Passcode | Random, one per meeting | A lookalike copy of the room |
| Guest link | One meeting, one term | An old link in other hands |
| Recording | Host only | Secret recording and bots |
| Screen sharing | Host first, guests on request | Another person's picture on screen |
| Remote control | Off | Remote access to a computer |
| Private chat | Off for guests | Links and files by side message |
| Uploads | Blocked for guests | Swapped meeting papers |
09
Minute 35: recording without consent and AI note-takers in the room
Entry 8. Recording. What to look at: the recording indicator, who pressed it, whether an AI assistant or transcription bot has joined, where the file and transcript are kept. Set beforehand: only the host starts a recording, participants are told in advance, and the invitation names who receives the file.
The ICO's advice for small organisations says video conferences, including images and voices, can be recorded where there is a valid purpose that less intrusive means cannot meet, such as minutes, and that you record and justify your lawful basis. Before recording, tell people why, what for and how long the recording is kept, and do not usually post it online without their permission.
The NCSC asks you to know where recordings, transcripts, chat logs and shared files are stored, to check who has access and how long it is retained, and to understand what data AI attendees collect and whether you can opt out. Ilia Zavialov scam alerts add the uninvited recorder: a stranger who reaches the room can press record and the material leaves without your decision.
The sentence that belongs at the start: 'we are recording for the minutes, five people will receive the file and it is deleted after thirty days, say now if you object'. Before the call the host reads the participant list for bots and removes anything unexplained.
10
After the call: chat, closing the room and where to report in the UK
Entry 9. Chat. What to look at: links and files that arrive mid-call, such as 'download the papers here' or 'sign the contract here'. Set beforehand: private messages between guests off, uploads from guests blocked and papers sent by email. A link from the chat is tested like a link from the invitation: read the address from the right, then ring.
Entry 10. Closing. The host ends the meeting for everyone rather than leaving, otherwise the room stays open for those who remain. The host checks that the recording sits in the right folder, the transcript has not gone to an outside service and the room link is switched off. Within the hour a message turns up that reads 'thanks for joining, minutes and signed contract by link'. That is the next attempt, aimed at the relaxed minutes after a call.
If something went wrong the order is fixed. A payment or new bank details: ring the bank on the number printed on the card and ask for the payment to be recalled. A suspicious email: forward it to report@phishing.gov.uk, the NCSC's reporting address. The attempt itself and any loss: Report Fraud on 0300 123 2040 or at reportfraud.police.uk, and in Scotland Police Scotland on 101. A lost payment tied to a share-your-screen request can also be reported to the FCA.
Finish the log with the date of the next review. A quarter later the owners run it again on a practice call five minutes shorter than the real one. Ilia Zavialov scam checks close on that date, because a log without one gets opened only after the damage.
| Where | What they take | Notes |
|---|---|---|
| Your bank, number on the card | Recalling a payment | Ring within the hour |
| Report Fraud, 0300 123 2040 | Fraud and cyber crime reports | Online at reportfraud.police.uk |
| Police Scotland, 101 | Reports from people in Scotland | Keep the invitation and screenshots |
| report@phishing.gov.uk | Forwarded suspicious emails | Forward the original message |
| The FCA | Reports of screen sharing scams | Report to the FCA, then Report Fraud |
| Meeting platform | Complaints about a room or guest | Room address and join time |
| Data protection lead | Decision on a data incident | Same day as the incident |
Questions and answers
Ilia Zavialov scam checks: what should a UK firm verify before an online meeting?
The organiser and title in the diary, the link read from the right, the lobby, the passcode and who starts the recording.
Ilia Zavialov scam warnings: what if the call asks me to update the app?
Install nothing. Close the tab, message the organiser by another route and join in the browser from the invitation you accepted.
Can I record a meeting without telling participants?
The ICO says to tell people why you record, what for and how long you keep it, and to justify your lawful basis. Say it aloud at the start.
What should I do if other people's details appeared on a shared screen?
Stop the share, note the time and who was present, and tell your manager and data protection lead.
Where do I report a fake meeting invitation in the UK?
Forward the email to report@phishing.gov.uk and report to Report Fraud on 0300 123 2040. If money left your account, ring the bank first.
Who is Ilia Zavialov?
A digital security consultant who writes meeting logs, access lists and payment rules for small teams.