{"id":928820,"date":"2026-10-11T09:02:09","date_gmt":"2026-10-11T09:02:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/ca\/928820\/"},"modified":"2026-10-11T09:02:09","modified_gmt":"2026-10-11T09:02:09","slug":"you-have-a-meeting-the-calendar-phishing-scam-growing-exponentially-scams","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ca\/928820\/","title":{"rendered":"\u2018You have a meeting\u2019: the calendar phishing scam growing exponentially | Scams"},"content":{"rendered":"

You\u2019re preparing for the week ahead and take a look at your Google<\/a> calendar. There\u2019s an entry for a meeting that you must have completely forgotten. The note that pops up when you click on it says you\u2019ll be reviewing a project and includes a link to more details. Confused, you follow it to find out more; the website you land on asks for logon details, and you provide them.<\/p>\n

Unfortunately, this was not a failure of your memory but a calendar phishing scam. You have handed your name and password to fraudsters who will sell it on in a batch with other people\u2019s details, use it to break into your work email, or to persuade you that they are contacting you from your bank<\/a>, or another institution.<\/p>\n

Luke Wescott, a threat detection engineer at Sublime Security, says calendar phishing is still relatively new but the company has seen \u201cexponential growth\u201d.<\/p>\n

The scam takes several forms, including a fake meeting, or a prompt to renew a service you pay for. In all, an entry appears in your electronic calendar.<\/p>\n

It ends up there after scammers send an email to your work, or personal address, with a calendar request. It doesn\u2019t matter if you miss it, or it ends up in your spam folder.<\/p>\n

Fake notifications of an auto-renewal are common to persuade people to respond and hand over personal details. Photograph: Sublime Security<\/p>\n

\u201cCalendar apps, such as Google Calendar, can add invitations automatically without users even accepting them,\u201d Wescott says. \u201cSo scammers don\u2019t even need you to open an email.\u201d<\/p>\n

And while you may not look twice at one from someone whose name you do not recognise, when something turns up in your calendar you may treat it differently. \u201cIt can create a borrowed credibility by showing up in the same place as your dentist appointment or a weekly 1:1 with your boss,\u201d he says.<\/p>\n

Max Gannon, an intelligence analysis manager at the cybersecurity company Cofense, says some scammers are using legitimate platforms such as Zoom to send the invitations, making them look more convincing to the recipients, and to security software.<\/p>\n

\u201cThat makes it really hard to block,\u201d he says. \u201cEven AI-backed blockers struggle.\u201d<\/p>\n

If you set up something to filter out invitations from these platforms, he says \u201cthat would also block any legitimate meeting invitations\u201d.<\/p>\n

What it looks like<\/p>\n

You will receive an email and see an entry in your calendar. The titles vary: examples seen by the Guardian include fake meetings, notifications of voicemail messages, and software renewals.<\/p>\n

Wescott says this is standard. \u201cWe typically see stuff like \u2018New voicemail received\u2019, \u2018Payment receipt confirmation \u2013 $298.99\u2019, \u2018PayPal unusual activity\u2019 warnings, \u2018Your auto-payment will be processed within 24 hours\u2019, and invitations to bid on a contract,\u201d he says.<\/p>\n

\"GoogleSometimes the calendar phishing scam uses fake voicemail notifications. Photograph: Supplied<\/p>\n

Gannon says the invitation could look like it has come from within your company. \u201cIf they want to they could make it look like an internal invitation,\u201d he says. \u201cThey can customise the content, may be adding the logo of your company.\u201d<\/p>\n

The event description will typically contain a link, or a phone number.<\/p>\n

Wescott adds: \u201cEither they want you to click a link to a fake login page like Microsoft, Google or PayPal, and enter your password, or to call a \u2018support\u2019 number to cancel a charge that never actually happened.\u201d<\/p>\n

Until you click on this, or make a call, you are not compromised. The scammers do not have access to everything in your calendar \u2013 they are just trying to lure you to a place where you will hand over your details.<\/p>\n

As Wescott says, \u201cit sounds familiar to typical phishing, it\u2019s the same technique, just using a different delivery method\u201d.<\/p>\n

What to do<\/p>\n

Don\u2019t panic if you see an unexpected meeting or reminder in your calendar. Treat it as you would an unexpected email and don\u2019t click on the link.<\/p>\n

\u201cMy number one advice is people just need to be paranoid,\u201d Gannon says. \u201cIt doesn\u2019t matter if the invitation has come from someone two desks down, you\u2019ve got to be suspicious of everything.\u201d<\/p>\n

Wescott advises turning off automatic accepting. In Google Calendar you can go into settings and opt to only accept invitations from known senders, or when you have accepted.<\/p>\n

He adds: \u201cDon\u2019t click \u2018decline\u2019 on suspicious invites as it can tell the sender that your address is \u2018live\u2019. Instead, delete or report it as spam\/junk.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"You\u2019re preparing for the week ahead and take a look at your Google calendar. There\u2019s an entry for…\n","protected":false},"author":2,"featured_media":928821,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[49,48,61],"class_list":["post-928820","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ca","tag-canada","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/928820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=928820"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/928820\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/928821"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=928820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=928820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=928820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}