How to stop Google Calendar spam before a fake invite gets you

Calendar spam used to be a nuisance. The new wave is built to steal accounts. Material Security says the campaign it uncovered dresses its invites up as missed payment notices, court summonses, requests to bid on contracts or voicemail alerts, and some come from an organization the target has already swapped emails with.

The links mostly point at Google itself, through Google’s own redirect service, shared Drive files or short share links, so tools that judge a link by its address see nothing wrong. Behind them sits a live relay placed in front of the real Google sign-in page. You type your password, approve the genuine prompt on your phone, and the attacker, watching in real time, walks off with your signed-in session. Text message codes, authenticator apps and Google’s number-matching phone prompt are all passed along the moment they arrive, so none of them stop it.

The company says it has caught over 99% of these messages since August and has had hundreds of the attackers’ domains taken down. The setup is cheap to rebuild, though. In one case a security certificate was issued 46 minutes before the domain it protected even existed.

It isn’t one gang, either. Sublime Security, another email security firm, says invite-based phishing climbed by roughly 33,000% between May and September. One of its engineers called it “exponential growth” and pointed out why it works: a scam event sitting next to your dentist appointment looks far more believable than a random email.

The most useful change is to stop Calendar from adding every invitation automatically. If it is set to accept invites from everyone, a scam event can appear on your calendar even when the email that delivered it gets filtered as spam.

1. Open Google Calendar in a web browser on your computer.
2. Click the gear icon at the top right and open Settings.
3. Under General on the left, open Event settings and find the option that controls how invitations get added to your calendar.
4. Change it to the choice that only adds events when the sender is known.

With that choice, an invite only lands on your calendar by itself if the sender is in your contacts, belongs to your workplace or school, or is someone you have dealt with before. Everyone else’s invitation stays in your email until you decide what to do with it.

There is a stricter option too: add events only after you reply to the invitation email. Nothing shows up on your calendar until you answer, which suits people who don’t get many invites. Google flags one side effect of the known-senders setting: a sender may be able to tell they aren’t in your contacts. The change also applies only to new invitations, not to events already on your calendar.

On a work or school account, your administrator decides which of these choices you can use. An option you can’t select has been switched off for your organization.

Changing the setting protects you from future invites, but it doesn’t clean up what’s already there. For that, report the event as spam: click it, open the More actions menu at the top right and pick the spam option. Reporting removes the event, and if it repeats, the whole series disappears with it. There is one limit: only invitations sent through Google Calendar can be reported. Events created by another calendar service or app can’t be.

Resist the urge to hit Decline. Security researchers warn that declining tells the sender your address is real and in use, which invites more of the same. Deleting or reporting is the safer move.

If the same person keeps sending junk, block them. Google added user blocking to Calendar in August, finished rolling it out by the end of September, and made it available on personal Google accounts as well as Workspace ones. On a computer, open one of their events, click More options at the top right and choose to block them. Calendar removes that event straight away and stops new invitations from that account.

What blocking won’t do

• It only works on a computer, not in the Calendar phone apps.
• It only covers Google accounts. For a sender on another email service, block their address in Gmail, which also stops their emails that create events.
• Older invitations from that person stay put until you delete them yourself.
• Updates to their earlier events can still trigger Gmail notifications unless you block the email address as well.
• If you once shared your calendar with them, they keep that access until you change your sharing settings.

The block also reaches beyond Calendar. The person joins your account-wide blocklist, which covers other Google services such as Photos, Chat and Drive. You can undo it from the blocklist page in your Google Account, but anything that was blocked won’t come back; they’d have to send fresh invitations.

The same invitation setting lives in the Google Calendar app on both Android and iPhone, so you can fix it from your phone in under a minute.

1. Open the Google Calendar app.
2. Tap the menu at the top left, then Settings.
3. Tap General, then the section about adding invitations.
4. Choose the known-senders option.

Phones add one more way in: an app with permission to write to your calendar. Google’s advice, if junk keeps appearing after you’ve tightened the invite setting, is to check which apps can reach your calendar. On Android, that lives in the Settings app under the privacy controls and the permission manager, where you can open Calendar and pull access from anything you don’t trust. Menu names vary between phone makers. Removing access stops new junk, but it won’t delete events that are already there.

Some spam shows up as a whole calendar rather than single events. In the Android app’s side menu you can untick any calendar you didn’t create so it stops showing, but Google says you also need to cut off the offending app’s access to stop new ones being made.

Google gives the same app-access advice to iPhone and iPad owners who still see spam after switching the setting. And if you connect Calendar to another service, such as Calendly or Asana, Google says to check that service’s own help pages for its spam controls.

A scam invite usually wants one of two things: a click on a link to a fake sign-in page for Google, Microsoft or PayPal, or a phone call to a fake support line to cancel a charge that never happened. Titles seen so far include auto-payment reminders, unusual-activity warnings, payment receipts and new voicemail alerts.

Simply seeing the event on your calendar doesn’t put you at risk. The scammers can’t read the rest of your schedule; they are trying to lure you to a page or a phone line. Treat a surprise meeting like a surprise email, and if it appears to come from a colleague, check with them another way before you click anything.

The current campaign raises the stakes because the prize is a live session, not just a password. A hijacked Google session can reach your email and Drive files, and can approve other apps’ access to the account in your name. Researchers say the response has to be fast: kill the active sessions, rein in any app permissions that were granted and reset the account, ideally within an hour. On work accounts, the evidence shows up in Workspace audit logs, so how quickly anyone notices depends on who is watching them.

Because this attack relays codes and prompts as they arrive, two-step verification won’t save you on its own here. The real protection is never typing your password into a page you reached from a calendar invite.