‘You have a meeting’: the calendar phishing scam growing exponentially

Calendar apps can add invitations automatically. Photograph: grinvalds/Getty Images View image in fullscreen Calendar apps can add invitations automatically. Photograph: grinvalds/Getty Images ‘You have a meeting’: the Phishing-scam" class="entity-link entity-topic" data-entity-id="216238" data-entity-type="topic">Calendar Phishing Scam growing exponentially Appointment or renewal reminder appears in victims’ calendar to lure them into logging in to fake Google, Microsoft or PayPal page Unfortunately, this was not a failure of your memory but a Phishing-scam" class="entity-link entity-topic" data-entity-id="216238" data-entity-type="topic">Calendar Phishing Scam. You have handed your name and password to fraudsters who will sell it on in a batch with other people’s details, use it to break into your work email, or to persuade you that they are contacting you from your bank, or another institution. Luke Wescott, a threat detection engineer at Sublime Security, says calendar Phishing is still relatively new but the company has seen “exponential growth”. The scam takes several forms, including a fake meeting, or a prompt to renew a service you pay for. In all, an entry appears in your electronic calendar. It ends up there after scammers send an email to your work, or personal address, with a calendar request. It doesn’t matter if you miss it, or it ends up in your spam folder. View image in fullscreen Fake notifications of an auto-renewal are common to persuade people to respond and hand over personal details. Photograph: Sublime Security “Calendar apps, such as Google-calendar" class="entity-link entity-organization" data-entity-id="81752" data-entity-type="organization">Google Calendar, can add invitations automatically without users even accepting them,” Wescott says. “So scammers don’t even need you to open an email.” And while you may not look twice at one from someone whose name you do not recognise, when something turns up in your calendar you may treat it differently. “It can create a borrowed credibility by showing up in the same place as your dentist appointment or a weekly 1:1 with your boss,” he says. Max Gannon, an intelligence analysis manager at the cybersecurity company Cofense, says some scammers are using legitimate platforms such as Zoom to send the invitations, making them look more convincing to the recipients, and to security software. “That makes it really hard to block,” he says. “Even AI-backed blockers struggle.” If you set up something to filter out invitations from these platforms, he says “that would also block any legitimate meeting invitations”. You will receive an email and see an entry in your calendar. The titles vary: examples seen by the Guardian include fake meetings, notifications of voicemail messages, and software renewals. Wescott says this is standard. “We typically see stuff like ‘New voicemail received’, ‘Payment receipt confirmation – $298.99’, ‘PayPal unusual activity’ warnings, ‘Your auto-payment will be processed within 24 hours’, and invitations to bid on a contract,” he says. Sometimes the Phishing-scam" class="entity-link entity-topic" data-entity-id="216238" data-entity-type="topic">Calendar Phishing Scam uses fake voicemail notifications. Photograph: Supplied Gannon says the invitation could look like it has come from within your company. “If they want to they could make it look like an internal invitation,” he says. “They can customise the content, may be adding the logo of your company.” The event description will typically contain a link, or a phone number. Wescott adds: “Either they want you to click a link to a fake login page like Microsoft, Google or PayPal, and enter your password, or to call a ‘support’ number to cancel a charge that never actually happened.” Until you click on this, or make a call, you are not compromised. The scammers do not have access to everything in your calendar – they are just trying to lure you to a place where you will hand over your details. As Wescott says, “it sounds familiar to typical Phishing, it’s the same technique, just using a different delivery method”. Don’t panic if you see an unexpected meeting or reminder in your calendar. Treat it as you would an unexpected email and don’t click on the link. “My number one advice is people just need to be paranoid,” Gannon says. “It doesn’t matter if the invitation has come from someone two desks down, you’ve got to be suspicious of everything.” Wescott advises turning off automatic accepting. In Google-calendar" class="entity-link entity-organization" data-entity-id="81752" data-entity-type="organization">Google Calendar you can go into settings and opt to only accept invitations from known senders, or when you have accepted. He adds: “Don’t click ‘decline’ on suspicious invites as it can tell the sender that your address is ‘live’. Instead, delete or report it as spam/junk.” Explore more on these topics Scams Scam watch Consumer affairs Cybercrime Data and computer security Internet safety Google features Share Reuse this content