Calendar invite phishing: how fake meeting invites work and how to stop them

A phishing email gets deleted. A calendar event stays, pops up a reminder, and sits next to real meetings with the same authority. That's the appeal of calendar invite phishing. The invitation arrives by email, but the payload lives in the event, often added to your calendar automatically before you've read anything. This guide explains how the attack works and the Google Workspace and Microsoft 365 settings that limit it.

What is calendar invite phishing?

It's a phishing message delivered as a meeting invitation. The invite might be a native meeting request or an attached .ics file, the standard calendar file format. The event title and description carry the lure:

• "Mandatory: 2026 benefits enrollment review" with a link to a fake sign-in page.
• "Invoice dispute call" with a phone number to ring, the callback phishing pattern.
• "Document shared with you: review before meeting" leading to a file-sharing phishing page.
• A QR code in the description, the quishing pattern.

Consumer spam uses the same mechanism for prize claims, crypto offers and fake purchase alerts.

Why attackers use calendars

Why do invitations appear on your calendar automatically?

Because it's convenient for real meetings. Both major platforms do it by default.

Google Calendar has a setting called Add invitations to my calendar with three options (Google Calendar Help):

Google defines a known sender as someone who is "in your contacts, part of your organization, or someone you previously interacted with." Google's August 2026 announcement says the admin control is set to From everyone by default (Google Workspace Updates).

Exchange and Microsoft 365 process meeting requests through the Calendar Attendant. Microsoft's documentation for Set-CalendarProcessing says that with AddNewRequestsTentatively set to $true, the default, "new calendar items are added to the calendar as tentative." So with default settings, a meeting request that reaches the mailbox can appear on the calendar as tentative before the person responds.

How do you stop calendar invite phishing in Google Workspace?

Set an organization-wide limit

At the time of writing (October 2026), in the Google Admin console go to Menu > Apps > Google Workspace > Calendar, then Advanced settings, and find Add invitations to Calendar (Google Workspace Admin Help). The options are:

• Invitations from everyone
• Invitations from known senders
• Invitations users have responded to via email

You set a least restrictive level and a default. Users can change their own setting "up to the least restrictive level" you allow. Google's August 2026 update made this a real limit for new and existing users, rolling out from August 14, 2026. Google says changes "can take up to 24 hours but typically happen more quickly," and apply "only to future invitations," not events already on calendars.

For most organizations, Invitations from known senders as both the limit and the default is a sensible choice. Staff still get invitations from new contacts by email and can accept them.

Tell staff about the personal setting

Users can check their own setting in Google Calendar under Settings > General > Event settings > Add invitations to my calendar. If they've chatted with a spammer's address before, it may count as known. Google's fix is to remove the sender from Other contacts in Google Contacts.

Keep Gmail filtering in front

Calendar spam starts as email. Gmail's spam, phishing and attachment protections still apply to the invitation message. See Gmail spam settings for Google Workspace.

How do you stop calendar invite phishing in Microsoft 365?

Microsoft doesn't document an admin control like Google's known-senders limit for user calendars. The admin controls Microsoft does document are at mail flow.

Filter external meeting requests with a mail flow rule

Exchange Online mail flow rules have a The message type is condition (MessageTypeMatches) with a Calendaring value (Microsoft Learn). You can combine it with The sender is located: Outside the organization to target external calendar messages. Microsoft doesn't spell out which messages count as Calendaring, so send yourself a test invitation from an outside account and confirm the rule matches. Options, from mildest to strictest:

1. Prepend a warning to the subject or body of external invitations.
2. Set the spam confidence level (SCL) for external invitations from senders outside a partner list. Microsoft says this is only an input to cloud filtering, not a final verdict, so don't rely on it alone.
3. Quarantine external invitations except from trusted domains, if your staff rarely receive outside meetings.

Microsoft's documentation doesn't say whether an ordinary email with an attached .ics file counts as Calendaring. If you want to catch those too, add a separate rule using Any attachment's file extension matches with the value ics, which is a documented condition. Test any rule in test mode first. Blocking all external invitations will stop real customer and supplier meetings.

Clean up after a campaign

If a phishing invite reached several people, remove it everywhere. In Microsoft Defender for Office 365 Plan 2, the Hard delete remediation action purges the message "and the corresponding calendar entry for meeting invite messages" (Microsoft Learn). Without Plan 2, ask users to delete the event, or use your admin tools to find and remove it. Our guide to Microsoft 365 message trace helps you find who received it.

What are the red flags in a calendar invite?

Phishing invites borrow the look of routine meetings, so the warning signs are in the details:

One flag is reason to check. Two or more, with a link or phone number, is reason to report it.

What should staff do with a suspicious calendar invite?

Teach three habits:

1. Don't respond. Accepting, declining or tentatively accepting sends a reply that confirms your address is active.
2. Don't click anything in the event. Links, phone numbers and QR codes in an unexpected invite deserve the same suspicion as those in a suspicious email. If it claims to be from a colleague or supplier, contact them through a channel you already know.
3. Report it, then remove it.

Reporting and removing in Google Calendar

On a computer, open the event, select More actions, then Report as spam. Google says reporting removes the event, and for recurring events "all events in the series are removed." One limit: only events sent from Google Calendar can be reported this way. "Calendar events created by another provider, app, or service can't be reported as spam" (Google Calendar Help). For those, report the invitation email and delete the event.

Reporting and removing in Outlook

Report the invitation email with your organization's report button. See how to report phishing. Then remove the event from the calendar, and don't pick any option that sends a reply to the organizer. If many people received the same invite, ask IT to remove it centrally rather than relying on each person to clean up.

On phones

If spam events appear only on a phone, check for a calendar subscription the user added by accident. Subscribed calendars aren't invitations, so the settings above don't stop them. Remove the subscription in the phone's calendar or account settings.

What if someone clicked a link in a calendar event?

Treat it like any other phishing click. Follow what to do after clicking a phishing link: change the password from a clean device, check for new sign-ins and MFA methods, and look for malicious inbox rules. If they called a number in the event and gave someone remote access, disconnect the device and contact IT straight away.

Next steps

• Google Workspace admins: set Add invitations to Calendar to known senders as both limit and default.
• Microsoft 365 admins: add a test-mode mail flow rule that tags external calendaring messages and .ics attachments, then decide whether to quarantine.
• Tell staff not to accept, decline or click in unexpected invites, and how to report them.
• Check the invitation's real sender with the Email Header Analyzer.
• Calendar spam arrives by email first, so filtering at the MX stops much of it before any calendar sees it. iBlockSpam filters phishing and spam at the MX, with allow and block lists for senders you never want to hear from.

Browse our other phishing and threat guides.