iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Close the page and stop interacting with the invitation. What to do next depends on whether you only opened the link, entered account details, shared a verification code, gave payment or identity information, or downloaded or installed something. A click alone does not prove your account was taken over or malware was installed, but the Federal Trade Commission (FTC) warns that even opening an unexpected link can expose you to scammers. Don’t use the invitation link again; reach any account provider through its official app or by typing its known address yourself.
First, stop the interaction
Close the browser tab or app showing the invitation. Don’t enter a password, passcode, verification code, payment details, or other personal information. Ignore pop-ups that claim your device is infected, give you a phone number to call, or tell you to install an app or pay for a repair. A warning displayed by the suspicious page is not proof that your device has a problem. Apple and the FTC both advise using trusted channels rather than following a suspicious prompt; see Apple’s guidance on social engineering and scams and the FTC’s phishing guidance.
If the page claimed that your email, calendar, or invitation account needs attention, open that provider’s app or enter its official website address independently. Check for alerts there. Do not sign in through a page reached from the invitation, even if its logo or wording looks familiar. The FTC’s September 4, 2024 alert says that opening an unexpected link can expose a person to scammers even without entering sensitive information; that warning does not mean every click results in an account compromise or an infected device. Read the FTC alert.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Identify what happened after the click
Use the action you actually took to choose a response. Receiving an unsolicited calendar event is not, on its own, evidence that someone accessed your calendar account. Likewise, clicking a link is different from giving away a password or installing a file.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| What happened | What to do next |
|---|---|
| You opened the link and did nothing else | Close it, don’t return to it, and consider checking the security activity of any account the page pretended to represent. |
| You entered a password or passcode | Change or reset that account’s password through the provider’s official app or site. If the password was reused, change it on every service where it was used. |
| You shared a one-time verification code | Treat the associated account as at risk and contact its provider through the official recovery channel. |
| You entered card, bank, Social Security, or other identity information | Contact the relevant financial institution through a known number or official app/site; for U.S. identity-theft steps, use IdentityTheft.gov. |
| You downloaded or installed a file, app, or configuration profile | Do not open a download you have not opened already. If you ran or installed something, use trusted security software to scan the device and follow organizational IT procedures on a work device. |
| You only received an unwanted event or invitation | Use the calendar provider’s official controls to report or remove it. An event appearing on the calendar does not establish that the account was hacked. |
If you only clicked the link
Close the page and do not revisit it through the invitation. If it appeared to imitate an account provider, visit that provider independently and review recent security activity or notifications. If you see an unfamiliar sign-in or a setting you did not change, follow the provider’s account-recovery instructions. Keep your browser, operating system, and security software updated.
A password change or malware scan is not automatically required just because a page opened. The FTC recommends updating security software and scanning when a link may have downloaded harmful software. If you saw a download begin, or the device behaved unexpectedly after the click, use the download guidance below. Do not enter credentials simply to see whether the invitation is genuine.
If you entered a password or shared a code
Change exposed passwords through the real provider
Use the provider’s official app or type its address yourself, then change or reset the password for the account whose credentials you submitted. If it was an Apple Account password, Apple says to change it immediately and ensure two-factor authentication is enabled when it may have been entered on a scam site. Apple’s account and scam guidance explains its recommendations.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you reused the password elsewhere, change it on each of those accounts as well. Give every account a unique password: changing only the password on the account named in the invitation leaves other accounts exposed if they use the same one. Turn on multi-factor authentication (MFA) where available. MFA adds a verification step to sign-in, but it does not replace changing a password that has been disclosed.
Check for changes an intruder could use
Review recent sign-ins and account security settings for unfamiliar activity. Check recovery email addresses and phone numbers, connected accounts, forwarding rules, and automatic replies. Microsoft specifically recommends checking connected accounts, forwarding, and automatic replies when recovering a compromised Microsoft account; use its Microsoft account recovery guidance for the provider’s recovery process.
If you shared a one-time verification code, treat the account as at risk even if you did not provide a password. Contact the provider through its official recovery route, secure the account, and review its sign-in activity. Do not send another code to someone who contacts you claiming to help. The FTC’s May 2026 alert describes fake invitation messages asking for email credentials or a special passcode; a familiar invitation service or host name does not make such a request legitimate. See the FTC’s invitation-scam alert.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you entered financial or identity information
If you supplied card or bank details, contact the bank or card issuer using the phone number printed on your card or a number in its official app or website. Explain what information you entered and ask whether the card or account should be blocked or replaced. Review transactions and statements for unfamiliar activity, and follow the institution’s instructions for disputing unauthorized transactions. Do not call a number shown in the invitation or on the suspicious page.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIf you shared a Social Security number or other personal information that could be used for identity theft, the FTC directs U.S. consumers to IdentityTheft.gov for steps tailored to the information exposed. The right response depends on what you provided; do not assume that canceling a payment card also addresses identity information. People outside the United States should use the applicable national identity-theft and financial-protection services.
If a file, app, or profile was downloaded or installed
Downloaded but did not open
Do not open the file or grant it permissions. Use your device’s normal file controls to remove it, then update existing trusted security software and run a scan if there is a possibility that the link downloaded harmful software. The FTC recommends updating security software, scanning, and removing anything the security tool identifies. Do not buy a cleanup service prompted by the invitation page or its pop-up.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Opened, ran, or installed something
Update trusted security software, run a scan, and follow the tool’s instructions for anything it detects. Don’t rely on a scam page’s own “scan” or diagnosis. If you installed an app or configuration profile, review the device’s installed apps and profiles using the operating system’s settings, and remove anything you recognize as unwanted using the device maker’s instructions. Apple warns that unwanted profiles or software may control a device or steal data; consult Apple’s guidance if the device is an Apple device.
If this is a work device or it was connected to a work network, report what happened to your organization’s IT or security team and follow its incident-reporting instructions. Avoid trying improvised cleanup steps on a managed device; your organization may need to preserve information or take specific containment steps. The FTC advises seeking trusted security help rather than buying repair from a suspicious pop-up. Its cybersecurity guidance also covers practical security measures for organizations.
Remove or report the calendar invitation
Use the calendar account’s official interface rather than a link or contact detail inside the event. Apple documents two relevant iCloud actions: mark a suspicious invitation as Junk, and delete a calendar you subscribed to unintentionally. The precise controls vary by service and device; follow the provider’s help instructions for your calendar. Apple’s support article covers unwanted invitations and subscriptions.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Do not reply to the sender or engage to ask whether the event is real. If the invitation arrived as an email in Gmail, Google’s documented phishing-report path is to open the message, select More, and choose Report phishing. That reports the email; it does not by itself establish that a calendar event or subscription was removed. For account alerts, open your Google Account directly and check its security notifications rather than following an email link. Google’s Gmail phishing guidance explains the reporting option.
After removing the event, check whether you accidentally subscribed to a calendar. If an unwanted calendar remains, remove the subscription through the calendar provider’s official settings. Deleting one event and removing an unwanted calendar subscription are different actions: the latter is relevant when unwanted events keep appearing from that calendar.
Report the scam through a trusted route
In the United States, the FTC lists reportphishing@apwg.org for suspicious email, SPAM (7726) for suspicious texts, and ReportFraud.ftc.gov for reporting fraud. Apple impersonation emails can also be forwarded to reportphishing@apple.com. These are U.S.-oriented reporting routes; elsewhere, use the relevant local authority and the provider’s built-in reporting controls. Reporting is separate from securing an exposed account, contacting a bank, or removing a calendar subscription.
Why a fake calendar invitation can be dangerous
Some scams use an unexpected event or party invitation to get a recipient to a page asking for an email password or a special passcode. The FTC’s May 2026 alert warns that scammers may impersonate familiar invitation platforms or a known host, and that a compromised account can be used to send the same scam to contacts. The invitation’s appearance is not a reliable way to verify it; use an independent channel to confirm with the supposed sender and never provide account credentials to view an event. The FTC describes this invitation scam.
Unwanted calendar invitations and subscriptions are also a known scam vector, but seeing an unsolicited event is not proof of account takeover. Separate the incident into what you observed and what you did: an event appeared, a link opened, information was submitted, or software was installed. That distinction determines whether you need to remove spam, secure an account, protect financial information, or inspect a device.
Quick Recap
Reduce the chance of a repeat
- Check unexpected event requests with the person or organization through contact details you already trust, not through the invitation.
- Open account services from a saved bookmark, the official app, or an address you enter yourself when an email or event claims there is an account problem. Google’s guidance similarly recommends going directly to the service instead of entering a password after following a message link.
- Use unique passwords and enable MFA for important accounts, especially email accounts that can reset passwords on other services.
- Keep device and browser software, along with trusted security software, updated. If a link may have downloaded a file, use that trusted software to scan rather than relying on a warning from the page.
- Use the calendar and message provider’s report, junk, and unsubscribe controls where appropriate; do not reply to a suspicious sender to make unwanted events stop.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
