Fake calendar invites are a fast-growing phishing scam
Scammers are slipping fake meetings and payment alerts straight into people's Google and Outlook calendars to steal passwords, security experts say. Calendar apps can add invites automatically, even if the email lands in spam. One security firm projected a roughly 33,000% jump in such attacks between May and September.
That meeting on your calendar you do not remember booking could be a scam.
Calendar phishing is growing fast, The Guardian reported. Scammers send an email with a calendar invite. Apps like Google Calendar can add the entry automatically, even if you never open the email or it lands in spam.
"Calendar apps, such as Google Calendar, can add invitations automatically without users even accepting them," said Luke Wescott, a threat detection engineer at Sublime Security. "So scammers don't even need you to open an email." He said his company has seen "exponential growth."
Security firm Sublime projected a roughly 33,000% increase in calendar-based phishing attacks between May and September, Digital Trends reported.
The entries often look routine. Wescott said common titles include "New voicemail received," "Payment receipt confirmation – $298.99," "PayPal unusual activity" and "Your auto-payment will be processed within 24 hours." Clicking the link leads to a fake login page that steals your password.
The trick works because people trust their calendars. An invite "can create a borrowed credibility by showing up in the same place as your dentist appointment," Wescott said.
Max Gannon of the security company Cofense said some scammers send invites through real platforms like Zoom. "That makes it really hard to block," he said. "Even AI-backed blockers struggle."
Even when email filters catch the message, the calendar entry often survives, Digital Trends noted.
To stay safe, do not click links in calendar entries you do not recognize. Check with the sender another way. You can also change your calendar settings so only invites from known contacts are added automatically.
What we know: Scammers are putting fake meetings and payment alerts into Google and Outlook calendars, and calendar apps can add them automatically.
What we don't: How many people have lost money to the scam.
Where outlets agree The Guardian and Digital Trends both report calendar apps can add scam invites automatically, even when the email is blocked.
Where they differ The outlets cited here report the same key facts so far.