# Calendar invite phishing: how fake meeting invites work and how to stop them

URL: https://iblockspam.com/blog/calendar-invite-phishing
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Phishing & threats
Author: iBlockSpam Team

> How fake meeting invites and .ics files put phishing links on your calendar, the Google Calendar and Outlook settings that help, and how to remove spam events.

## Short answer

Calendar invite phishing sends a meeting request or .ics file whose event description holds a phishing link or phone number. Many calendars add invites automatically, so the event stays even after the email is deleted. In Google Workspace, limit invitations to known senders. In Microsoft 365, filter external calendar items, and remove events without replying to the organizer.

A phishing email gets deleted. A calendar event stays, pops up a reminder, and sits next to real meetings with the same authority. That's the appeal of calendar invite phishing. The invitation arrives by email, but the payload lives in the event, often added to your calendar automatically before you've read anything. This guide explains how the attack works and the Google Workspace and Microsoft 365 settings that limit it.

## What is calendar invite phishing?

It's a phishing message delivered as a meeting invitation. The invite might be a native meeting request or an attached `.ics` file, the standard calendar file format. The event title and description carry the lure:

- "Mandatory: 2026 benefits enrollment review" with a link to a fake sign-in page.
- "Invoice dispute call" with a phone number to ring, the [callback phishing](https://iblockspam.com/blog/callback-phishing-phone-scam-emails) pattern.
- "Document shared with you: review before meeting" leading to a [file-sharing phishing](https://iblockspam.com/blog/file-sharing-notification-phishing) page.
- A QR code in the description, the [quishing](https://iblockspam.com/blog/qr-code-phishing-quishing) pattern.

Consumer spam uses the same mechanism for prize claims, crypto offers and fake purchase alerts.

### Why attackers use calendars

| Advantage | Why it matters |
|---|---|
| Automatic placement | Many calendars add invites before the person responds |
| Persistence | The event can survive after the email is deleted or moved to junk |
| Reminders | The lure reappears as a notification, sometimes on a phone |
| Borrowed trust | People treat their calendar as their own, organized space |
| Less training | Most awareness training focuses on emails, not events |

## Why do invitations appear on your calendar automatically?

Because it's convenient for real meetings. Both major platforms do it by default.

**Google Calendar** has a setting called **Add invitations to my calendar** with three options ([Google Calendar Help](https://support.google.com/calendar/answer/13159188)):

| Option | What happens |
|---|---|
| From everyone | "All invitations are automatically added to your calendar." |
| Only if the sender is known | Invitations from known senders are added; others arrive only by email |
| When I respond to the invitation in email | "An event is added to your calendar only after you respond to the email notification." |

Google defines a known sender as someone who is "in your contacts, part of your organization, or someone you previously interacted with." Google's August 2026 announcement says the admin control is set to **From everyone** by default ([Google Workspace Updates](https://workspaceupdates.googleblog.com/2026/08/new-admin-controls-for-adding-invitations-to-Google-Calendar.html)).

**Exchange and Microsoft 365** process meeting requests through the Calendar Attendant. Microsoft's documentation for [Set-CalendarProcessing](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-calendarprocessing) says that with `AddNewRequestsTentatively` set to `$true`, the default, "new calendar items are added to the calendar as tentative." So with default settings, a meeting request that reaches the mailbox can appear on the calendar as tentative before the person responds.

## How do you stop calendar invite phishing in Google Workspace?

### Set an organization-wide limit

At the time of writing (October 2026), in the Google Admin console go to **Menu > Apps > Google Workspace > Calendar**, then **Advanced settings**, and find **Add invitations to Calendar** ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/calendar/automatically-add-events-to-calendars)). The options are:

- Invitations from everyone
- Invitations from known senders
- Invitations users have responded to via email

You set a **least restrictive** level and a **default**. Users can change their own setting "up to the least restrictive level" you allow. Google's August 2026 update made this a real limit for new and existing users, rolling out from August 14, 2026. Google says changes "can take up to 24 hours but typically happen more quickly," and apply "only to future invitations," not events already on calendars.

For most organizations, **Invitations from known senders** as both the limit and the default is a sensible choice. Staff still get invitations from new contacts by email and can accept them.

### Tell staff about the personal setting

Users can check their own setting in Google Calendar under **Settings > General > Event settings > Add invitations to my calendar**. If they've chatted with a spammer's address before, it may count as known. Google's fix is to remove the sender from **Other contacts** in Google Contacts.

### Keep Gmail filtering in front

Calendar spam starts as email. Gmail's spam, phishing and attachment protections still apply to the invitation message. See [Gmail spam settings for Google Workspace](https://iblockspam.com/blog/gmail-spam-settings-google-workspace).

## How do you stop calendar invite phishing in Microsoft 365?

Microsoft doesn't document an admin control like Google's known-senders limit for user calendars. The admin controls Microsoft does document are at mail flow.

### Filter external meeting requests with a mail flow rule

Exchange Online mail flow rules have a **The message type is** condition (`MessageTypeMatches`) with a **Calendaring** value ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)). You can combine it with **The sender is located: Outside the organization** to target external calendar messages. Microsoft doesn't spell out which messages count as Calendaring, so send yourself a test invitation from an outside account and confirm the rule matches. Options, from mildest to strictest:

1. **Prepend a warning** to the subject or body of external invitations.
2. **Set the spam confidence level (SCL)** for external invitations from senders outside a partner list. Microsoft says this is only an input to cloud filtering, not a final verdict, so don't rely on it alone.
3. **Quarantine** external invitations except from trusted domains, if your staff rarely receive outside meetings.

Microsoft's documentation doesn't say whether an ordinary email with an attached `.ics` file counts as Calendaring. If you want to catch those too, add a separate rule using **Any attachment's file extension matches** with the value `ics`, which is a documented condition. Test any rule in test mode first. Blocking all external invitations will stop real customer and supplier meetings.

### Clean up after a campaign

If a phishing invite reached several people, remove it everywhere. In Microsoft Defender for Office 365 Plan 2, the **Hard delete** remediation action purges the message "and the corresponding calendar entry for meeting invite messages" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/remediate-malicious-email-delivered-office-365)). Without Plan 2, ask users to delete the event, or use your admin tools to find and remove it. Our guide to [Microsoft 365 message trace](https://iblockspam.com/blog/microsoft-365-message-trace) helps you find who received it.

## What are the red flags in a calendar invite?

Phishing invites borrow the look of routine meetings, so the warning signs are in the details:

| Red flag | Why it matters |
|---|---|
| You don't know the organizer, or the address is external | Real internal meetings come from colleagues' accounts |
| The meeting has no agenda, just a link or a number | The event exists to deliver the link |
| The description asks you to sign in, verify or pay before the meeting | Real meetings don't need a password to "unlock" |
| The organizer's domain doesn't match the brand in the title | A "Microsoft" or "HR" meeting from an unrelated domain |
| Dozens of attendees you don't know, or hidden attendees | Bulk spam sent to many addresses at once |
| A meeting link that isn't your usual meeting platform | Lookalike join pages can collect credentials |
| Urgency: "today," "mandatory," "account will be closed" | Pressure to act before thinking |

One flag is reason to check. Two or more, with a link or phone number, is reason to report it.

## What should staff do with a suspicious calendar invite?

Teach three habits:

1. **Don't respond.** Accepting, declining or tentatively accepting sends a reply that confirms your address is active.
2. **Don't click anything in the event.** Links, phone numbers and QR codes in an unexpected invite deserve the same suspicion as those in a suspicious email. If it claims to be from a colleague or supplier, contact them through a channel you already know.
3. **Report it, then remove it.**

### Reporting and removing in Google Calendar

On a computer, open the event, select **More actions**, then **Report as spam**. Google says reporting removes the event, and for recurring events "all events in the series are removed." One limit: only events sent from Google Calendar can be reported this way. "Calendar events created by another provider, app, or service can't be reported as spam" ([Google Calendar Help](https://support.google.com/calendar/answer/13155911?hl=en&co=GENIE.Platform%3DDesktop)). For those, report the invitation email and delete the event.

### Reporting and removing in Outlook

Report the invitation email with your organization's report button. See [how to report phishing](https://iblockspam.com/blog/report-phishing-email). Then remove the event from the calendar, and don't pick any option that sends a reply to the organizer. If many people received the same invite, ask IT to remove it centrally rather than relying on each person to clean up.

### On phones

If spam events appear only on a phone, check for a calendar subscription the user added by accident. Subscribed calendars aren't invitations, so the settings above don't stop them. Remove the subscription in the phone's calendar or account settings.

## What if someone clicked a link in a calendar event?

Treat it like any other phishing click. Follow [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link): change the password from a clean device, check for new sign-ins and MFA methods, and look for [malicious inbox rules](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding). If they called a number in the event and gave someone remote access, disconnect the device and contact IT straight away.

## Next steps

- **Google Workspace admins:** set **Add invitations to Calendar** to known senders as both limit and default.
- **Microsoft 365 admins:** add a test-mode mail flow rule that tags external calendaring messages and `.ics` attachments, then decide whether to quarantine.
- Tell staff not to accept, decline or click in unexpected invites, and how to report them.
- Check the invitation's real sender with the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).
- Calendar spam arrives by email first, so filtering at the MX stops much of it before any calendar sees it. iBlockSpam filters phishing and spam at the MX, with [allow and block lists](https://iblockspam.com/features/allow-block-lists) for senders you never want to hear from.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Why are spam events showing up on my calendar?

Because your calendar adds invitations automatically. When a meeting request arrives by email, Google Calendar and Exchange can place it on your calendar before you respond. Spammers use this to put links and phone numbers where you'll see them repeatedly. In Google Calendar, change 'Add invitations to my calendar' to 'Only if the sender is known'.

### Should I decline a spam calendar invite?

No. Declining sends a reply to the organizer, which confirms your address is active. In Google Calendar, use Report as spam, which removes the event without that step. In Outlook, report the invitation email, then remove the event without picking any option that sends a reply. Don't click anything in the event description.

### Can a calendar invite contain a virus?

An .ics file is plain text describing an event, so it doesn't run code by itself. The danger is what it contains: links to fake sign-in pages, QR codes, phone numbers for callback scams, or attachments added to the event. Treat links in an unexpected invite exactly as you would links in a suspicious email.

### Does deleting the phishing email remove the calendar event?

Not always. The event can stay on the calendar after the message is gone. In Microsoft Defender for Office 365, Microsoft says the hard delete remediation action purges the message 'and the corresponding calendar entry for meeting invite messages'. Otherwise, remove the event from the calendar separately.

### What counts as a known sender in Google Calendar?

Google defines a known sender as someone in your contacts, part of your organization, or someone you've previously interacted with. Invitations from anyone else still arrive by email, but the event only goes on your calendar after you respond. To stop treating a sender as known, remove them from Other contacts in Google Contacts.

## Sources

- [Google Calendar Help: Manage invitations in Calendar](https://support.google.com/calendar/answer/13159188)
- [Google Workspace Admin Help: Automatically add events to calendars](https://knowledge.workspace.google.com/admin/calendar/automatically-add-events-to-calendars)
- [Google Workspace Updates: New admin controls for adding invitations to Google Calendar (August 2026)](https://workspaceupdates.googleblog.com/2026/08/new-admin-controls-for-adding-invitations-to-Google-Calendar.html)
- [Google Calendar Help: Report inappropriate calendar invitations and events](https://support.google.com/calendar/answer/13155911?hl=en&co=GENIE.Platform%3DDesktop)
- [Microsoft Learn: Set-CalendarProcessing](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-calendarprocessing)
- [Microsoft Learn: Mail flow rule conditions and exceptions in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)
- [Microsoft Learn: Remediate malicious email that was delivered in Office 365](https://learn.microsoft.com/en-us/defender-office-365/remediate-malicious-email-delivered-office-365)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/calendar-invite-phishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt