Scam alert
Meeting on Your Calendar You Never Made? Don't Click Its Link
Posted
United States · theguardian.com · Arrives by a calendar invitation sent by email
The short answer
A calendar entry you never made, such as a meeting, a renewal, a voicemail notice, or a payment receipt, with a link or phone number in it, is a phishing lure. The Guardian and Business Insider reported in October 2026 that these invitations are on the rise. Scammers email the invite, and calendar apps such as Google Calendar can add it automatically, even if the email landed in spam. Don't click the link or call the number. Delete the entry or report it as spam instead of declining, and set your calendar to add invitations only from known senders.
What is happening
On October 11, 2026, The Guardian reported that Sublime Security has seen "exponential growth" in calendar phishing: an emailed invite puts a fake meeting, voicemail notice, payment receipt, or software renewal on your calendar, with a link to a fake Google, Microsoft, or PayPal login page or a "support" number for a charge that never happened. On October 12, Business Insider reported that Sublime found calendar-led attacks rose more than tenfold in August from July, and that a midyear Microsoft report found they nearly quadrupled in June from May. It said people in sales, recruiting, and other jobs that involve meeting strangers online are especially exposed.
How to recognize it
- An entry appears on your calendar for a meeting, renewal, voicemail, or payment you don't remember, and its description holds a link or a phone number.
- The link opens a sign-in page for Google, Microsoft, PayPal, or another account and asks for your password.
- The entry gives a support number to call to cancel a charge you never made.
- The invite looks like it came from inside your company, or it arrives through a real meeting service such as Zoom.
- An invite from someone you know, such as a court summons, asks for financial details. Their email account may have been taken over.
What to do instead
- Treat an unexpected calendar entry like an unexpected email: don't click its link or call its number.
- Delete the invite or report it as spam or junk. Declining it can tell the sender your address is live.
- In Google Calendar settings, choose to add invitations only from known senders or once you have accepted them. Look for a similar setting in other calendar apps.
- If a meeting might be real, ask the organizer through a phone number or address you already have.
- Sign in by opening the app or typing the address yourself, and use a passkey where one is offered.
- If you want to tell someone, the rule is: a calendar entry you didn't make gets deleted, not clicked.
If it already happened
Responding to one of these is common and understandable. These steps are what people usually take next.
- Clicking a link on your own calendar is common and understandable. These entries are built to sit next to real appointments and look routine.
- If you typed a password, change it right away through the real site or app, and turn on two-step sign-in. If it was a work account, tell your IT or security team.
- If you called the number and paid or read out card details, call your card company on the number on the back of the card.
- Report it at ReportFraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov.
Common questions
- I never accepted the invite. How did it get on my calendar?
- The Guardian reported that calendar apps such as Google Calendar can add invitations automatically, even when the email was missed or went to spam. Until you click the link or make the call, you are not compromised, and the scammers do not have access to everything in your calendar.
- It looks like it came from a coworker. Does that make it real?
- Not on its own. A cybersecurity expert told The Guardian that an invite can be made to look internal, even with your company's logo, and Business Insider described a hacked email account sending fake court-summons invites to its contacts. Check with the person another way.
Practice this safely
Practice pausing on a message you didn't expect, and checking it through a route you already trust.
Every story is fictional. There is no timer, no score, and no real message, payment, or account.
Tell someone
Copy a short note you can paste into a text or email. It names the scam, the next step, and this page. Nothing is sent from this site.
Meeting on Your Calendar You Never Made? Don't Click Its Link A calendar entry you never made, such as a meeting, a renewal, a voicemail notice, or a payment receipt, with a link or phone number in it, is a phishing lure. The Guardian and Business Insider reported in October 2026 that these invitations are on the rise. Scammers email the invite, and calendar apps such as Google Calendar can add it automatically, even if the email landed in spam. Don't click the link or call the number. Delete the entry or report it as spam instead of declining, and set your calendar to add invitations only from known senders. Read the full alert: https://endscamsproject.com/latest-scams/calendar-phishing-invite-scam
Where this comes from
These links open the published sources in a new tab. The destination is shown before you open it.
- The Guardian: 'You have a meeting': the calendar phishing scam growing exponentially (October 11, 2026) (opens in a new tab)
theguardian.com
- Business Insider: Calendar Invite Scams Are Rising, and AI Makes Them More Convincing (October 12, 2026) (opens in a new tab)
businessinsider.com
- Report fraud to the Federal Trade Commission (opens in a new tab)
ReportFraud.ftc.gov
The full guide on this
More recent alerts
This alert provides general educational information drawn from the sources above. It cannot determine whether a specific message you received is genuine, investigate an incident, or promise recovery or reimbursement.