Calendar Invite Phishing Scam

Overview

Scammers send fake meeting or "renewal" events directly to victims' Google Calendar, Outlook, or iPhone calendars, exploiting auto-add settings to bypass spam filters and push phishing links or fake billing phone numbers straight onto people's schedules.

How It Works

Instead of (or in addition to) a normal phishing email, criminals send a calendar invite — an iCal/.ics event — through legitimate platforms like Google Calendar or Microsoft Outlook. Because many calendar apps are set by default to automatically add invites from unknown senders, the fake event lands directly on the victim's calendar even if the originating email itself is caught by spam filters, since the invite is processed through calendar infrastructure rather than the inbox. The event is disguised as something urgent or financial — a large "invoice," "bonus payout," "investment," or a fake multi-year software renewal notice for several hundred dollars — and its description urges the victim to call a phone number to "dispute" or "cancel" the charge, or to click an embedded link. Some newer variants add the malicious link or phone number only after the invite has already synced to the calendar, so it never passes through any filter at all. Calling the number connects the victim to a fake "billing support" agent who then tries to extract payment or personal/financial information, while clicking the link can lead to credential-harvesting pages.

Red Flags

• An unexpected calendar event appears that you never agreed to, often titled things like "invoice," "bonus payout," "investment," or "urgent meeting"
• A calendar "receipt" or billing notice for a large, attention-grabbing dollar amount shows up as an event instead of through your normal billing email or account portal
• The event description urges you to call a phone number immediately to dispute or cancel a charge rather than log into the real service
• The invite keeps reappearing on your calendar even after you delete it, including across synced devices
• The sender is an unfamiliar or random email address, not the company or person the event claims to be from

Real Examples

• Malwarebytes reported in November 2025 a surge in phishing calendar invites that users couldn't delete or that kept reappearing because they synced across devices.
• Malwarebytes later identified a campaign sending fake calendar invites impersonating Malwarebytes itself, with large multi-year "renewal" charges in the event description urging victims to call a fake billing support number to dispute the charge.
• Security researchers described a related "two-stage" Google Calendar spam technique where a malicious link is added to an event's notification only after it has already synced to the victim's calendar, so it never passes through any spam filter.

Where It Spreads

How to Protect Yourself

• Turn off automatic adding of invitations in your calendar settings (Google Calendar, Outlook, Android, and iOS all have options to require you to accept an invite before it's added) so unsolicited events stay as emails instead of appearing on your schedule
• Never call a phone number or click a link found inside an unexpected calendar event; instead, check your account directly through the company's official app or website
• When deleting a suspicious event, use "Do not send a response" or decline options so you don't confirm to the scammer that your email address is active, and block or report the sender as spam
• Enable multi-factor authentication on your email and calendar accounts so attackers who obtain credentials can't abuse the account to send or auto-accept further invites
• In shared or resource calendars, remove public/anonymous access and restrict who can create or edit events

Related Scams