A calendar invite scam is a phishing attempt delivered through an unexpected event or meeting invitation, and the risk is not limited to clicking a link. The event may claim that a subscription renewed, an account is at risk, a payment failed, or a document is waiting, then push you to open a link, call a listed number, reply, open an attachment, approve access, or send money. Quietly deleting the invitation is not always enough either; report the event through the calendar's own controls so it does not linger or keep returning.

Key Takeaways

An unfamiliar invite is not proof that your calendar account was hacked.

Do not reply, accept, decline through an unfamiliar link, or call a number in the event description.

Verify the claim by opening the named service through its official app or a saved address.

Report the event with the calendar provider's own controls, then respond according to what you exposed.

The safest first move is to treat the event as an untrusted message. The broader online security guide explains the same independent-channel rule for email, texts, calls, and account alerts.

How does a calendar invite scam work?

The sender creates an event and adds your email address as a guest. Depending on your calendar settings, the event may appear automatically, appear only after you respond, or remain visible beside legitimate appointments. Google has documented fraud campaigns that placed fake renewal notices directly into calendar invitations.［1］

The event description supplies the actual trap. It may contain a button that opens a fake sign-in page, a telephone number that reaches an impostor, an attachment presented as an invoice, or instructions to approve a new application. The calendar entry creates urgency because it occupies a time slot and can trigger repeated reminders.

Deleting the invitation email is not always enough. Microsoft notes that a meeting item can remain in a calendar after the associated email has been removed, which is why calendar-specific reporting and remediation matter.［2］ This persistence does not prove deeper access; it reflects how email and calendar objects can be handled separately.

What warning signs should you check?

One clue is not a verdict. Use the whole pattern and verify the underlying claim independently.

Signal	Why it matters	Safer check
You do not recognize the organizer	The sender has no established reason to schedule you	Search your own records for the person or organization
The event announces a renewal or charge	A calendar invite is an unusual billing channel	Open the service from a saved bookmark and inspect billing there
The description demands immediate action	Urgency reduces careful checking	Stop and verify before the reminder deadline
The link domain differs from the named service	The destination may be a credential-harvesting page	Do not open it; navigate to the official site manually
The event asks for a password, code, gift card, or crypto payment	Legitimate calendar invitations should not collect secrets or irreversible payment	Use the provider's official support channel
The invite keeps returning	The sender may be resending it or your settings may auto-add events	Report it and review invitation settings

A normal unsolicited event can still be spam rather than targeted phishing. A forged organizer name can also look familiar while the underlying address is unrelated. If you need a broader explanation of sender impersonation and fake sign-in pages, read what phishing is.

How should you verify an unexpected invitation or fake meeting invite?

Use a clean verification path that does not depend on anything inside the invite.

Do not click links, open attachments, call listed numbers, or send a response.
Identify the claim: a meeting, purchase, renewal, shared file, account alert, or support case.
Open the relevant service from its official app, a saved bookmark, or an address you type yourself.
Check whether the meeting, charge, file, or warning exists in that trusted account.
If the organizer might be real, contact them through a previously known address or number.
Use the calendar provider's report-spam control, then remove the event through the provider's documented flow.

Google Calendar provides an in-product reporting route and settings that control which invitations appear automatically.［3］ Exact labels can change, so use the provider's current Help page instead of instructions embedded in the suspicious event.

Do not press a prominent “unsubscribe” link inside the event. That link can lead to the same phishing site or confirm that your address is active. A calendar's native report or delete control is different because it stays inside the service you already trust.

Does the invite mean your account was hacked?

Usually, no. Anyone who knows or guesses an address may be able to send an invitation, just as they can send an email. The event appearing on your calendar can result from invitation settings rather than unauthorized access.

Account compromise becomes more plausible if you also see events created by your own account, changes to sharing settings, unfamiliar forwarding rules, unknown sessions, sent invitations you did not create, or security alerts confirmed inside the official account. In that case, follow the steps for an unfamiliar account login: change the password from a trusted device, revoke unknown sessions, review recovery details, and enable strong MFA.

Do not change a password by following the invite's link. Open the provider directly so the recovery action cannot be captured by the same phishing page.

What should you do after interacting with the invite?

Match the response to the highest level of exposure rather than treating every case as a full breach.

You only received or viewed it

Report and remove the event using the calendar service. Review invitation visibility settings if unsolicited events appear automatically. No password change is normally required when you did not click, disclose information, install anything, or approve access.

You opened the link but entered nothing

Close the page. Do not download anything it offers or grant notification permission. Check the browser's downloads and remove an unneeded file without opening it. If you want a broader sequence, use the checklist for when you have clicked a phishing link.

You entered a password or verification code

From a trusted device, open the real service and change the affected password immediately. Revoke unfamiliar sessions, confirm recovery email and phone details, and protect any other account that reused the password. If you disclosed a one-time code, assume the attacker may already have completed a login.

You approved an app or calendar permission

Review connected applications and delegated calendar access in the official account settings. Remove the unfamiliar grant, revoke related sessions, and inspect sharing rules. A password change alone may not cancel an application token or delegated permission.

You paid or gave card details

Contact the bank, card issuer, or payment provider through its official channel. Ask about blocking the payment method and disputing or recalling the transaction where available. Save the event, organizer address, destination domain, receipt, and conversation before deleting local evidence.

How can you reduce future calendar spam?

Keep invitation behavior conservative. Where supported, show events from known senders or add invitations only after you respond. Limit public exposure of the email address tied to a personal calendar, especially on public contact pages and event-registration lists.

Protect the account itself with a unique password, MFA, current recovery details, and periodic review of connected apps. Calendar settings reduce nuisance entries, while account controls reduce damage if credentials or permissions are stolen. They solve different problems.

For work calendars, report suspicious events to the security or IT team before deleting them if company policy asks you to preserve evidence. Administrators may be able to remove related meeting objects across multiple mailboxes, while an individual deletion affects only your view.

Summary

Treat an unexpected calendar event as an untrusted message, not a verified account notice.
Verify meetings, renewals, payments, and files through an official app or independently opened site.
Report the event inside the calendar provider because deleting the email alone may not remove it.
Do not assume account takeover unless official settings, sessions, sent items, or security alerts provide supporting evidence.
Escalate recovery according to what you clicked, disclosed, approved, downloaded, or paid.

Frequently Asked Questions

Can accepting a calendar invite infect my phone or computer?

Accepting an event normally changes its attendance status; the greater risk is opening a malicious link or attachment, installing a file, or following unsafe instructions. Avoid interacting with suspicious content and use the provider's report function.

Should I decline a suspicious invitation?

Use the provider's documented spam-reporting flow instead of replying through the event. A normal decline can notify the sender that the address is active, while a link labeled “decline” inside the description may go somewhere else entirely.

Why did a spam event appear without my approval?

Some calendar configurations display invitations automatically or after related email activity. That behavior does not by itself show that the sender entered your account. Review the service's invitation settings and account activity separately.

Is deleting the invitation email enough?

Not always. Email and calendar objects can be remediated separately, and the event may remain after the message is gone. Report or remove the event through the calendar interface as well.

Can a real contact send a malicious invite?

Yes. Their account could be compromised, or the organizer name could be forged. Confirm an unusual request through a previously known communication channel, especially before sharing credentials, approving access, or paying.

What if the invitation says I already paid for a subscription?

Do not call the listed number or use its cancellation link. Open the service or card account independently and check for a real charge. If no matching transaction exists, report the invite; if one exists, contact the provider through official support.

Does a VPN stop calendar invite scams?

No. A VPN can protect network traffic in appropriate contexts, but it cannot decide whether an organizer is genuine, stop you from entering credentials on a fake page, or reverse a payment. Independent verification and account controls address this scam.

Who should I report a calendar phishing attempt to?

Report it to the calendar provider using its in-product control. For a work account, follow the organization's security-reporting process. If money or identity data was lost, also contact the relevant financial institution and the fraud-reporting authority for your location.

Disclaimer: This article provides general cybersecurity and consumer information, not legal, financial, or incident-response advice. Procedures and recovery rights vary by provider and location.

Sources:

Google — Fraud and scams advisory, June 2026 — https://blog.google/innovation-and-ai/technology/safety-security/fraud-scams-advisory-june-2026/
Microsoft Defender for Office 365 — Strengthening calendar security through enhanced remediation — https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-calendar-security-through-enhanced-remediation/4456876
Google Calendar Help — Report spam calendar invitations — https://support.google.com/calendar/answer/13155911?hl=en-IN

Sources checked 4 October 2026.

Related articles:

What Is a Calendar Invite Scam?