What Is Calendar Phishing and How to Prevent It

Calendar phishing is a scam that hides a malicious link inside a calendar invitation instead of a normal email, so it lands directly on your schedule, sets a reminder, and sits next to your real meetings. It works because a calendar invite feels more trustworthy than a cold email, and because Google Calendar and Microsoft 365 can add invites automatically before you decide whether to trust them. This guide explains what calendar phishing is, how to spot it, and the exact settings and habits that stop it, for both individuals and whole teams.

What’s in This Guide

What Calendar Phishing Is and Why It Works

Calendar phishing is a form of social engineering that uses fake calendar invitations to deliver the same payload as a phishing email: a malicious link, a lure to call a fraudulent number, or a prompt to hand over credentials or payment details. Instead of hoping you open an email, the attacker gets an event onto your calendar, where it carries a reminder and the built-in credibility of something you scheduled.

That credibility is the whole point. Years of investment in spam and phishing email filters have trained attackers to look for channels those filters do not watch as closely. A calendar invite is one of them. When the invite is generated by a legitimate service such as Google Calendar, it can even arrive from a real, trusted domain, which helps it sail past defenses that would have flagged a suspicious email.

Phishing is not a fringe problem, and the calendar is one of its newer delivery routes. In its 2024 Internet Crime Report, the FBI’s Internet Crime Complaint Center (IC3) logged more phishing and spoofing complaints than any other crime category, part of a record 859,532 total complaints and $16.6 billion in reported losses. Attackers do not adopt a new technique unless it works, and calendar-based delivery keeps growing because it reaches inboxes that filters would otherwise protect.

If you want the fuller picture of how common and costly these attacks have become, our breakdown of current phishing volume, costs, and defense data puts hard numbers behind the trend. Calendar phishing is phishing that changed its address of delivery.

Source: FBI IC3 2024 Internet Crime Report

How a Calendar Phishing Attack Actually Happens

Understanding the mechanics makes the invite easy to recognize. Most calendar phishing follows a predictable sequence, and security researchers have documented large campaigns that use it.

In late 2024, Check Point Research documented a campaign that sent more than 4,000 phishing messages in four weeks, affecting around 300 organizations across sectors including education, healthcare, construction, and banking. The attackers manipulated sender headers so messages appeared to come from Google Calendar on behalf of a known person, then routed victims through Google Forms or Google Drawings to a page disguised as a reCAPTCHA or support button, and finally to a fake site that harvested personal and payment information. The typical flow looks like this:

• Craft the invite: the attacker creates an event and adds your email address as a guest, or sends a calendar file (an .ics attachment) designed to be added to your schedule.
• Ride the auto-add: because of default settings, the event appears on your calendar, often as a tentative hold, before you have accepted or even seen an email about it.
• Bait the click: the event title and description use urgency or reward (a payment problem, a prize, a shared document, a job offer) and contain a link, QR code, or phone number.
• Harvest or infect: the link leads to a credential-stealing page or a malware download, and the fake reminder gives the attacker a second chance to reach you at the scheduled time.

The reason this bypasses so many defenses is that each step uses legitimate infrastructure. A real calendar service sends the invite. A real Google Forms or Microsoft page hosts the next step. Only the final destination is clearly malicious, and by then the victim has followed a trail of trusted-looking pages. It is a close cousin of the trick covered in our guide to phishing that clones a legitimate message you were expecting, applied to the calendar instead of the inbox.

Source: Check Point Research: Google Calendar phishing analysis

How to Spot a Calendar Phishing Invite

The warning signs are consistent, and once you know them a malicious invite is easy to identify. Treat any invite that shows one or more of these as suspicious until proven otherwise.

The same instincts that catch a fraudulent email catch a fraudulent invite. If you want to sharpen those instincts across your team, our guides to the warning signs that give a phishing message away and real phishing examples broken down side by side translate directly to calendar invites.

Step 1: Turn Off Automatic Invitations in Google Calendar

This is the most important fix for anyone on Google Calendar or Google Workspace, because Google Calendar has historically added invitations to your calendar automatically by default. Changing one setting removes the auto-add that the entire attack depends on.

What to do: open Google Calendar on the web, click the gear icon and choose Settings, then select Event settings. Find Add invitations to my calendar and change it from From everyone to either Only if the sender is known or When I respond to the invitation in email. (In older versions of the interface the same control is labeled “Automatically add invitations,” where you choose “No, only show invitations to which I have responded.”)

Why this matters: “Only if the sender is known” is the setting Google specifically recommends against this attack. It stops invitations from people who are not in your contacts, and whom you have never emailed, from silently appearing on your calendar.

What success looks like: unexpected events from strangers no longer show up on your schedule. Invites from real colleagues and contacts still arrive normally, so nothing you actually need is lost.

Source: Google Calendar Help: invitation and event settings

Step 2: Restrict Calendar Auto-Adds in Microsoft 365 and Outlook

Microsoft 365 and Outlook are also targeted, and while they usually require a user to accept an invite, they can still place an invitation on the calendar as a tentative event, which is enough to plant the bait and its reminder. Tighten the same behavior here.

What to do: in Outlook, turn off automatically adding events from email so message content is not auto-processed onto your calendar. In new Outlook and Outlook on the web this lives under Settings > Calendar > Events from email, where you can stop events from being added automatically. At the organization level, an administrator should enable Microsoft Defender for Office 365 protections (Safe Links and Safe Attachments) and mail-flow rules that filter or quarantine suspicious invitations before they reach users.

Why this matters: individual settings protect one person; tenant-level controls protect everyone at once and cover the users who never change a default. Filtering the invite before delivery is more reliable than depending on each person to notice it.

What success looks like: invites are not silently auto-added, risky links inside invitations are rewritten and scanned by Safe Links, and your administrator has a rule in place to catch obvious invite-based lures.

Source: Microsoft Support: events from email in your calendar | Microsoft Defender for Office 365

Step 3: Report Suspicious Invites as Spam, Then Delete

How you get rid of a bad invite matters. Reporting it before deleting it does more than clean your calendar; it feeds the platform’s filters and helps protect other users who may be hit by the same campaign.

What to do: open the suspicious event, use the More options (three-dot) menu, and choose Report as spam where available, then delete it. In Google Calendar you can report an invite as spam directly from the event. Do this before deleting, and never RSVP, click a link, scan a code, or call a number inside an invite you did not expect.

Why this matters: declining an invite can signal to an attacker that your address is live and monitored, which can invite more attempts. Reporting as spam both removes the event and improves detection for the next target.

What success looks like: suspicious invites are reported and gone, you have interacted with nothing inside them, and repeat attempts from the same source taper off as the platform learns.

Step 4: Train Your Team to Recognize the Bait

Settings stop the automatic invites, but people still receive and open the ones that get through. For a business, employee awareness is the layer that turns each person from a target into a sensor.

What to do: teach your team three things. First, a calendar invite is not automatically trustworthy just because it appeared on their schedule. Second, the red flags from earlier in this guide (urgency, rewards, unknown senders, links and QR codes and phone numbers) apply to invites exactly as they do to email. Third, there is a single, easy way to report anything suspicious, so reporting is the reflex rather than clicking.

Why this matters: phishing succeeds by manipulating people, not just software. Ongoing awareness training and simulated phishing measurably reduce how often employees fall for these lures and how quickly they report the ones they spot.

What success looks like: employees pause on unexpected invites, report them through a known channel, and treat a calendar entry with the same healthy skepticism they would give a surprise email asking for money or credentials.

Add phishing awareness training and email security for your team

Step 5: Add Layered Email and Endpoint Defenses

No single control catches everything, so the goal is defense in depth: several layers so that if one fails, another stops the attack. This is where the organization-wide, technical protections come in.

What to do: combine the settings above with a stack of reinforcing controls:

• Advanced email and invite filtering: modern, AI-assisted filtering that inspects links and attachments inside invitations, not just plain email, and rewrites or detonates suspicious links before a user can reach them.
• Multifactor authentication (MFA): so that even if a user’s credentials are phished, a stolen password alone does not unlock the account.
• Endpoint detection and response (EDR): to catch and contain malware if a link does lead to a download.
• Continuous monitoring: eyes on alerts around the clock, so a successful click is detected and contained in minutes rather than discovered weeks later.

Why this matters: the calendar is one delivery route among many, and attackers rotate through whatever gets past your defenses. Layered controls protect against the whole family of phishing and social engineering, not just the calendar variant.

What success looks like: a phishing invite that slips past the settings still meets a filter, MFA, an alert, and a monitored response, so a single mistake never becomes a breach.

Get round-the-clock monitoring for your business

When to Call a Professional

Troubleshooting Common Problems

A few situations come up often once people start locking calendar phishing down. Here is how to handle them.

How to Maintain and Monitor Your Defenses

Stopping calendar phishing is not a one-time task, because attackers change tactics and new employees join with default settings. Keep the protection current:

• Bake the settings into onboarding, so every new user’s calendar auto-add is locked down from day one rather than left on the risky default.
• Refresh awareness training regularly, and include calendar-based examples alongside email phishing so the lesson stays relevant.
• Review your filtering and rules as your platform and the threat landscape change, and act on what your reports surface.
• Keep monitoring in place, because the fastest way to limit damage from any phishing attempt is to detect a successful one quickly.

Maintaining that rhythm is exactly the kind of ongoing discipline a managed provider handles, so your defenses do not quietly drift back to defaults over time.

Put an experienced security leader in charge of your defenses

Frequently Asked Questions

David McFarlene Founder & CEO

David McFarlene is the owner and founder of CNiC Solutions, a trusted IT services and cybersecurity company serving the Houston, TX area. With over 20 years of experience in managed IT, infrastructure design, cloud solutions, and data security, David helps businesses and homeowners stay protected and productive through dependable, personalized technology support. He leads the CNiC Solutions team with a focus on reliability, transparency, and long-term relationships, ensuring clients always have a knowledgeable expert they can trust.

See Full Bio

IT Services Network Cabling Cloud Solutions Cybersecurity Data Backup & Recovery Managed IT Services Infrastructure Management Telecommunications Virtual CIO (vCIO) WebRTC