We’ve all gotten pretty good at spotting suspicious emails, with their unexpected attachments and claims that we’ve won some jackpot. But scammers are finding new ways to get our attention, and their latest trick is showing up right on our calendars. Fake calendar meeting invitations are becoming a growing phishing threat, and they work because a fake invite can easily blend in with everything else on your schedule, and if it’s on the schedule we trust that it must be there for a reason.
How Does Calendar Phishing Work?
The concept is simple. Instead of sending you a traditional phishing email and hoping you click a link, scammers create a fake meeting or calendar event designed to get you to take action.
The invitation may look legit, use familiar company branding and even appear directly in your Outlook or Google Calendar even when you never intentionally accepted it. The goal is usually to steal your login credentials, gain access to your accounts or convince you to hand over money or sensitive information. And because the invitation is sitting in your calendar rather than looking like an obvious phishing email, you may be less likely to question it.
What Should You Do If You Find a Suspicious Meeting?
A little caution goes a long way.
1. Don’t click links just because they’re in your calendar.
An unexpected meeting invitation is not automatically trustworthy. Don’t click a Join Meeting button, scan a QR code or open an attachment unless you’ve verified that the request is legitimate.
2. Check who sent the invitation.
Look beyond the display name. Does the sender’s email address match the organization or person they’re claiming to represent? Were you expecting the invitation? Does the subject make sense in the context of your work?
3. Verify the request another way.
If an invitation appears to come from a client, coworker, vendor or service provider, contact them another way you know is legitimate (calling their cell or Slacking them for instance.) Just don’t use the contact information included in the suspicious invitation.
4. Delete the event and report it.
If you determine that an invitation is fraudulent, report it through your organization’s normal phishing-reporting process and remove the event from your calendar.
5. If you’ve already clicked, don’t panic—but act quickly.
If you entered a password on a suspicious website, change it immediately using the legitimate service’s website. If you use that password elsewhere, change it there, too. Notify your IT or security team if this involves a work account. If you approved an unexpected sign-in, entered a verification code or granted an application access to your account, report that as well. Changing a password alone may not be enough if an attacker has obtained an active session or authorization.
How Can You Prevent These Invitations?
There are a few steps you can take to reduce your exposure.
- Keep your software and security tools up to date. Email filtering and endpoint protection are important, but organizations should also ensure their security processes account for suspicious calendar invitations and attached .ics files.
- Use multifactor authentication. MFA adds an important layer of protection if a password is stolen. For stronger protection against phishing, consider passkeys or security keys where supported.
- Be cautious with unexpected requests. Urgent messages involving billing, payroll, account access, document signatures or security alerts deserve extra scrutiny regardless of where they appear.
How Can You Check Your Calendar Settings?
You can reduce unwanted invitations by reviewing your calendar’s automatic event settings. Check whether Outlook, Google Calendar, or your other calendar application automatically adds invitations or events from email. Where appropriate, change the settings so invitations aren’t automatically placed on your calendar.
- Google Calendar: Go to Settings → General → Event settings → Add invitations to my calendar. Choose Only if the sender is known, or the stricter option that adds invitations only after you respond by email, if available.
- Outlook: Review Settings → Calendar → Events and invitations, or the Automatic processing settings in classic Outlook on the web. Options vary by version and account type. Your IT administrator may also be able to apply organization-wide protections.
Need help? Contact us at go@support.whatarmy.com
Need a hand with your WordPress site? Every WhatArmy care plan covers updates, backups, security and fixes, from $150 a month. See the WordPress support plans.
