The Consult Request That Isn’t: How to Spot the Fake Zoom Link Scam Targeting Therapists
A Polite Email With One Small Request Maya, a clinician in private practice, opens her inbox on a busy Monday and finds a courteous message from a prospective client. They […]
A Polite Email With One Small Request
Maya, a clinician in private practice, opens her inbox on a busy Monday and finds a courteous message from a prospective client. They are looking for weekly therapy, they seem motivated, and they would love to get started this week. There is just one wrinkle. Instead of the phone consultation Maya usually offers, the sender asks to meet on their own Zoom link. It seems like a small favor, and an open slot on her calendar is tempting.
Then she remembers a message from a colleague in her professional community (thanks Alden!). Several therapists had received nearly identical inquiries, and the pattern was hard to ignore. The person declines a phone call, pushes for their own video link, and moves quickly. Maya closes the email and replies with her standard intake steps. It may have been the best two minutes of her week.
What Is Happening and Why It Matters
A clinician in our community, Alden, recently shared that she has been receiving email inquiries from potential clients who insist on using their own Zoom link. Her usual practice is to offer a phone consultation first. When someone refuses, she treats it as a red flag. If a video consult is truly wanted, she sends a HIPAA compliant link from her own account. Her concern is that the link could be a scam designed to install malware on a therapist’s computer.
That concern is well founded. In February 2026, security firm Malwarebytes reported on a fake Zoom meeting page that displayed a broken call with looping audio and made-up participants. After a few seconds, an “update available” pop-up appeared and triggered a download. The download quietly installed a legitimate employee-monitoring program that can record keystrokes, capture screenshots, and copy clipboard contents. Real estate associations issued similar warnings about fake Zoom links earlier this year. Therapists have also faced other scams over the years, such as overpayment check schemes, so this is one more evolution of an old playbook.
What This Means for a Private Practice
Solo clinicians are appealing targets for a simple reason. Our contact information is public in directories and on websites, and our devices hold sensitive information. A single click could put email accounts, saved passwords, banking access, and client records within reach of a stranger. If protected health information is exposed, you may also face breach notification duties under HIPAA, which adds stress, cost, and the difficult task of telling clients.
The challenge is that we do not want to become so guarded that we turn away real people who need help. Most inquiries are honest, and many clients feel nervous about reaching out. The opportunity is to build an intake process that is warm, consistent, and safe at the same time. When every prospective client follows the same steps, a scammer stands out quickly, and a genuine client simply experiences a professional practice.
The Business Case for a Consistent Intake Process
A clear intake routine protects your clients, your reputation, and your time. It keeps your devices and records safe, and it saves you from spending hours untangling a security problem that could have been avoided in a single email. It also signals the care that clients are looking for when they choose a therapist.
Your video platform is part of that picture. According to the HIPAA Journal’s January 2026 update, Zoom can support HIPAA compliance only when a practice signs Zoom’s Business Associate Agreement, uses an eligible business account rather than a free plan, and configures the service properly. Covered entities cannot substitute their own agreement. I use the built in telehealth software in my EHR. In the past, I used the free Doxy.me telehealth platform. Whatever platform you choose, confirm these details directly with the vendor, and consider asking your attorney or liability insurer if you have questions. It is also wise to review your cyber liability coverage while you are at it, since many professional policies treat data breaches differently from malpractice claims.
Your Action Plan: 6 Steps to a Safer Intake
- Make a phone consultation your default first step. A short call lets you hear the person, ask a few questions, and gauge fit. If someone refuses a phone call and pushes hard for video only, treat that as a signal to slow down.
- Host every video meeting yourself. Send prospective clients a link from your own HIPAA compliant platform, covered by a signed Business Associate Agreement. Politely decline any link that someone else sends you.
- Keep a friendly script ready. Try something like: “For client privacy and security, I host all video sessions through my secure platform, and I will send you a link.” A genuine client will understand, and it removes the awkwardness of saying no.
- Never install anything that a meeting link asks for. Legitimate meetings do not require surprise updates, plug-ins, or files. If a page tells you to download something, close it, and open your video app directly instead of clicking the link.
- Strengthen your everyday defenses. Keep your operating system and software updated, use reputable security software, turn on multi-factor authentication, and store passwords in a password manager. Consider using a separate device or user profile for client work.
- Know your plan if you click by mistake. Disconnect from the internet, run a security scan, and change key passwords from a different, clean device. Then contact an IT professional, ask your attorney or liability insurer about any breach duties, and consider reporting the attempt to the FBI’s Internet Crime Complaint Center at ic3.gov.
The Bottom Line
Caring about clients includes caring about the systems that protect them. You do not need to be a security expert to keep your practice safe. You need a few simple habits, a friendly script, and a community that shares what it sees. Our colleague who spoke up did every clinician in her network a favor, and we are grateful for members who look out for one another. Share this post with a colleague today, so more of us stay one step ahead. A few minutes of preparation now can spare you a great deal of worry later, and it lets you keep your focus where it belongs, on the people you serve.
Ready to grow your practice and connect with like-minded clinicians?
Sign up for free and connect with other clinicians in your city. https://sananetwork.com/join/
Written by AI & Reviewed by Clinical Psychologist: Yoendry Torres, Psy.D.
Disclaimer: Some blog posts may contain affiliate links, earning Sana Network a commission at no additional cost to you. These recommendations reflect our honest opinions about products or services we find helpful and trustworthy. This content is informational and not legal nor medical advice; consult an attorney or healthcare provider for personalized guidance.
