Calendar Phishing: Check Unexpected Meetings and Renewals

The Guardian's 11 October report describes phishing delivered through calendar invitations: fake meetings, voicemail alerts and renewal reminders that steer people towards imitation Google, Microsoft or PayPal login pages, or a supposed support number. This is fresh reporting on a scam technique, not an announcement that those services have been breached.

Sublime Security's Luke Wescott told the newspaper his company had seen growth in this activity. The report supplies no independently verified population-wide attack count, so the useful takeaway is the delivery method rather than a numerical estimate of its scale.

Depending on your settings, an invitation can appear in your calendar without you first accepting it. Google confirms that its 'From everyone' option automatically adds invitations sent directly to your email address. Seeing a suspicious event is therefore not, by itself, evidence that an intruder can read your calendar or has signed into your account.

A reminder next to your genuine appointments can look like something you arranged and forgot. Scammers exploit that context: the event's description may ask you to sign in to see details, or call urgently to cancel an invented charge.

Open the relevant service's app or type its known website address yourself to check a renewal or payment. Verify an unexpected work meeting with the supposed organiser through a separate, familiar channel. Do not use the invitation's link or telephone number to verify the invitation itself.

On a computer, open Google Calendar, then Settings, Event settings and 'Add invitations to my calendar'. Choose 'Only if the sender is known' or 'When I respond to the invitation in email' instead of automatically adding invitations from everyone.

Google defines known senders as people in your contacts, your organisation or those you have previously interacted with. That is a convenience filter, not proof that a message is safe. The response-based setting also does not make a malicious invitation safe to accept.

Google says changes apply only to new invitations. Work or school administrators may restrict the available options. It also warns that the known-sender choice might reveal to senders that they are not in your contacts.

For a suspicious event sent from Google Calendar, open the event's own menu and choose More actions, then 'Report as spam'. Google says this removes the event, including the series if it repeats. Its help page explicitly says events created by another provider, app or service cannot use this reporting option; use that provider's spam or removal guidance instead.

The researcher quoted by the Guardian advises deleting or reporting suspicious invitations rather than declining them, because a response can signal that your address is active. Removing an event is housekeeping, not a substitute for account recovery if you already supplied information.

If you entered a password on a suspicious page, go directly to the genuine service to change it, replace any reused password elsewhere and review active sessions and recovery details. Enable multifactor authentication where available. Tell your IT team promptly if it was a work account, and contact your bank through a trusted route if you shared payment details or sent money.

A VPN encrypts the connection between your device and the VPN server. It does not decide whether a meeting organiser is genuine, change your calendar's invitation policy or prevent you handing credentials to a fake site. Even an encrypted connection can carry information straight to a scammer's website.

Our guide to what a VPN hides explains that network-versus-account boundary. The ASOS explainer below covers another reason a message can seem credible: a scammer may know personal details. Neither familiar context nor a VPN connection is proof of identity.