Scammers have found a new place to slip in their messages: your calendar. Instead of relying only on an email that might get caught by a spam filter, they send a fake calendar invite that shows up as an event on your schedule, often with a link, an attachment, or a phone number to call. The scam works because calendar events feel routine and trustworthy, and because it plays on urgency, like a charge you didn't make or a meeting you think you can't miss.

How the Scam Works

A calendar invite can show up in your email inbox and on your calendar at the same time. That matters, because even when your email filter flags the message as suspicious, the event may already be sitting on your calendar.

Here's how it usually goes:

  • You get an invite you weren't expecting. It might come from someone you don't know, look like it's from a familiar service like Zoom, or even appear to come from inside your own company. As Max Gannon of the email security company Cofense told The Guardian, "If they want to, they could make it look like an internal invitation."
  • The event includes a "lure." That could be a link, an attachment, a meeting link, or a phone number, along with a reason to act quickly.
  • Calendar reminders make it feel official. Because the event pops up at a set time, it can feel like something you're supposed to respond to.
  • You're asked to take a small step. Click the link, sign in, download a file, or call "customer support."

The goal isn't to get you to attend a meeting. It's to trick you into handing over your login information, installing harmful software, or talking to a scammer on the phone.

Security researchers have also found harmful software tucked into some of these invites, including programs that can secretly watch and control a device.

Calendar-Invite-Scam

These Scams Are Growing Quickly

Calendar invite scams aren't new, but they've grown sharply this year. The email security company Sublime reported that calendar invite attacks rose 1,216% from July to August 2026 alone, according to Inc. Sublime's 2026 Email Threat Research Report also found that calendar invites accounted for nearly 20% of callback phishing attempts in the last quarter of 2025. These scams also cost very little to send, since attackers often use free services to create them.

Calendar Invite Scams Can Look Like:

  • A "security review" or account alert that links to a fake sign-in page
  • A meeting with a "vendor" that includes an invoice, file, or login link
  • A job interview invite for a job you didn't apply for
  • A request to update payroll, benefits, tax, or direct-deposit information
  • A warning about a purchase or charge, with a number to call
  • A prize, refund, or "urgent instructions" you weren't expecting

Red Flags to Watch For

  • An invite from someone you don't know or can't confirm
  • An event that appeared on your calendar without you accepting it
  • Links, attachments, or phone numbers inside the event
  • A message about a charge, account problem, or payment you don't recognize
  • Pressure to act right away, especially before the "meeting" starts
  • A request to sign in, download something, install software, send a payment, or call a number

That last one alone is a big red flag. Whenever a calendar event asks you to do something with your accounts or money, it's worth being suspicious.

Why This Scam Works

We tend to trust our calendars. They hold doctor's appointments, family dinners, and work meetings, and most of us don't think of them as a place scammers can reach. Calendar phishing takes advantage of that trust, then adds urgency on top. These scams are built to fool sharp, careful people, so if one has caught your attention, you're not alone.

How to Protect Yourself

  • Don't click links, open attachments, or call numbers inside an unexpected invite. If you want to check an account, go directly to the company's website or app by typing the address yourself.
  • Confirm the sender another way. If an invite looks like it's from a coworker, a company, or a service you use, reach out through a phone number or address you already know is real.
  • Turn off automatic adding of events from email. This keeps invites in your inbox until you choose to add them, so strangers can't place events on your calendar on their own. Both Google Calendar and Microsoft Outlook have settings for this.
  • Delete suspicious events without responding. Don't click "Yes," "No," or "Maybe." Any reply can tell the scammer your address is active and can be targeted again. Block the sender if you can.
  • Turn on multifactor authentication. This adds a second layer of security, like a code sent to your phone, so a stolen password alone isn't enough to get into your account.

If You Think You've Been Targeted

If you clicked a link, entered your password, downloaded a file, or called a number from a calendar invite, act quickly:

  • If it was a work calendar, tell your IT team or account administrator right away.
  • Change the password for any account you signed into, and turn on multifactor authentication.
  • Keep an eye on your bank accounts and cards for activity you don't recognize.
  • Report the scam to the FTC at reportfraud.ftc.gov.

Remember, this is a relatively new type of scam, so this happens to a lot of people. The sooner you act, the easier it is to limit the damage.

Stay One Step Ahead

Scammers are constantly changing their tactics, but staying informed is one of the best ways to protect yourself and the people you love. If a calendar scam does lead to someone getting into your accounts, Carefull watches your bank accounts and cards around the clock and alerts you to unusual activity, so you can catch problems early. Try Carefull free for 30 days.