Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An unexpected calendar invite is not proof that your account has been hacked, but it can be a phishing attempt. Treat unfamiliar invitations as untrusted: don’t follow links, open attachments, scan QR codes, or provide passwords or payment details. Report the event through your calendar provider and change invitation settings where available.
Why calendar invites can be used for phishing
A calendar invitation can carry scam text and links in its title, description, or attached calendar file. The lure may look like a renewal notice, prize, work meeting, government message, or security alert. Branding and urgency are not evidence that the invitation is genuine.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
The Complete Guide to Gmail: Step-by-Step to Master Email Productivity, AI & Gemini Features,... | $6.99 | Buy on Amazon |
Calendar files such as .ics invitations may be processed differently from ordinary email attachments. Microsoft’s Q2 2026 threat report describes malicious links being added to calendars without a separate open-and-click interaction. Google said it investigated “Calendar Phishing” bypasses in which fake renewal notices were placed directly in Google Calendar invites. These examples explain why deleting a related email may not remove an event already added to a calendar; they do not mean every invitation is malicious or that simply seeing an invite infects a device. Google’s June 2026 advisory and Microsoft’s Q2 2026 report describe the mechanisms.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe FBI advises against clicking a link or opening an attachment—or an unexpected calendar invitation—from someone you do not recognize. If an invite appears to come from a person or organization you know, confirm it using a separate, trusted channel rather than replying to contact details in the invitation. The FBI’s calendar-fraud guidance and Apple’s phishing guidance recommend caution with unsolicited messages and their links or attachments.
What the threat figures do—and do not—show
Recent figures describe particular security vendors’ observed data, not the odds that an individual will receive a scam invite. Microsoft said ICS calendar invitations accounted for roughly 4% of overall payload volume in its Q2 2026 telemetry, while that volume rose 277% in June. The report characterizes the share as small despite the sharp monthly increase. Sublime Security’s 2026 report says calendar invites were one delivery method in more than 20% of callback-phishing attacks it observed in Q4 2025. The datasets, periods, and denominators differ, so these numbers should not be compared directly or treated as population-wide rates.
Separately, TechRadar reported on September 18, 2026, that Sublime projected an approximately 33,000% increase from May to September 2026. That is a vendor projection relayed in secondary reporting—not a measured increase in all calendar scams, nor a measure of personal risk. Sublime’s 2026 report and TechRadar’s report of that projection provide the respective context.
How to handle an unexpected invitation
- Don’t interact with the suspicious content. Avoid links, attachments, QR codes, and requests for passwords, payment, or personal details. An urgent deadline or familiar-looking logo does not make an invite trustworthy.
- Verify through another route if it might be legitimate. Contact the supposed sender using a phone number, address, or website you already trust—not details supplied in the event.
- Report or remove the event using the calendar provider’s controls. The exact option depends on where the event came from and how the calendar was added.
- Review invitation settings. Use a known-sender or approval option if your calendar service offers one. These controls can reduce unwanted events but may not apply to every imported or subscribed calendar.
- If you entered a password or other sensitive information, secure the account promptly. Use the provider’s official recovery process; do not return to the link in the invitation.
Google Calendar: report the event and limit automatic additions
Report an event sent from Google Calendar
Open the event, select More actions, then choose Report as spam. Google says reporting removes the event and, if it is part of a recurring series, removes the series too. This reporting control applies to events sent from Google Calendar; it does not cover events created by another provider, app, or service. See Google Calendar Help.
Require a known sender before adding invitations
- In Google Calendar, open Settings.
- Under General, select Event settings.
- For Add invitations to my calendar, choose Only if the sender is known.
Google defines a known sender as someone in your contacts, someone in your organization, or someone you have interacted with. Google warns that this choice might reveal to senders that they are not in your contacts. The setting is documented in the current Google Calendar Help; don’t assume it is enabled by default.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Apple Calendar and iCloud: report junk or remove a subscribed calendar
Apple documents reporting suspicious or unwanted calendar invitations in Mail or Calendar as Junk in iCloud. If you unintentionally subscribed to a spam calendar, delete that subscription. Follow the relevant steps in Apple Support’s guidance.
The Apple guidance cited here does not establish a cross-provider “known senders only” setting equivalent to Google Calendar’s. These actions are specifically documented for iCloud and unwanted subscribed calendars; they should not be assumed to apply to every calendar app or account.
If you already entered information
If you supplied an Apple Account password or personal information on a scam site, Apple advises changing the Apple Account password immediately and ensuring two-factor authentication is enabled. For another provider, go directly to its official account-recovery process. If you entered payment details, contact your bank or payment provider using a trusted number or website. Apple’s guidance covers Apple Account recovery steps.
What about Outlook and other calendar services?
Microsoft’s Q2 2026 report documents calendar-based threat techniques, but the guidance cited here does not establish current consumer Outlook cleanup or invitation-setting steps. Controls vary by provider and by whether an event is imported or subscribed, so don’t apply Google or iCloud instructions to another service without checking its official help.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
