Calendar invite scams disguise credential theft, payment fraud, or malicious app authorization as an ordinary meeting or event. The safest response is to stop interacting, verify the organizer through a separate channel you already trust, and immediately secure any account or permission you may have exposed.
What a calendar invite scam is
A calendar invite scam is a social-engineering attack delivered through an event invitation, a meeting notice, or an “You’re invited” email or text. The attacker borrows credibility from a familiar calendar format or a name you recognize, then tries to move you to a dangerous next step: entering a password, supplying a one-time code, paying an invoice, downloading a file, or approving access for an unfamiliar application.
As an Amazon Associate I earn from qualifying purchases.
The event itself may look normal. It can contain a plausible title, a professional logo, a meeting time, and a sender name copied from a colleague or service. Those details are presentation, not proof. The important questions are who actually sent it, where every link goes, and what the invitation asks you to do.
Not every unsolicited event is malicious. A legitimate contact may have the wrong address, an automated service may add a reminder, or a provider may have imported an event. Treat an unexpected invitation as untrusted until you confirm it independently.
How the scams work
Credential and passcode harvesting
The Federal Trade Commission (FTC) describes unexpected invitation-themed emails and texts that impersonate services such as Evite or Paperless Post. A message may use the name of someone you know as the host, then request your email username and password to view the details. Another variation asks for your phone number and a “special” RSVP code.
Those requests are not normal RSVP requirements. They are attempts to obtain credentials or information that can be used to reset an account. If an attacker gains access to an email account, the account can become a new source of apparently trustworthy invitations sent to the victim’s contacts. The FTC’s May 2026 consumer guidance puts the point plainly: “These fake invitations ask for your email login credentials or a special pass code to open them, but don’t do it.”
Fake meeting, renewal, or account notices
An invitation may claim that a subscription is expiring, a payment failed, or a meeting must be “confirmed” before it is canceled. Google’s June 2026 advisory says it investigated fake renewal notices added directly to Google Calendar invitations and deceptive meeting or calendar invitations used in impersonation campaigns.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Seeing the notice inside a calendar workflow does not make it a calendar-provider message. An event can be created by another account, application, or service and then displayed by your calendar. Check the sender and destination rather than trusting the location in which the notice appears.
OAuth consent phishing
In an OAuth consent attack, the invitation supplies a pretext—often an event planner or coordinator who needs you to “verify” your identity. The link can open a genuine-looking sign-in and permission screen from a familiar identity provider. The danger is the application requesting access behind that screen.
The FBI Internet Crime Complaint Center (IC3) warns that OAuth consent phishing can provide persistent access. Once permission is granted, changing the password does not necessarily invalidate the application’s token. The victim must remove or revoke the unfamiliar application from the account’s security or connected-app settings.
Why the calendar format is effective
- Calendar entries are associated with work, appointments, and people the recipient may already know.
- Many users review the event title and time without expanding the sender, description, or link destination.
- An event can appear in a trusted calendar application even when it was created by an unrelated account or service.
- A request to “RSVP,” “confirm,” or “view details” sounds routine and can hide the real objective.
Warning signs to check before you respond
The invitation is unexpected or has no context
Be especially cautious when the event comes from a new or infrequent sender, has no connection to your schedule, or appears without a preceding conversation. Microsoft advises slowing down for first-time or infrequent senders. A familiar display name is not enough; inspect the underlying address.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe sender does not match the claim
Look for a domain that is unrelated to the organization named in the event, a subtly misspelled domain, or a personal address posing as a company, school, venue, or colleague. Attackers may change one character, add a word, or use a lookalike subdomain. Compare the full address with one you have previously used—not merely the name shown in the calendar.
It asks for a password, one-time code, or “verification”
An unexpected invitation should never require you to send an email password, multifactor code, recovery code, or special RSVP passcode. Do not type the information into a page reached from the invitation either. If you need to access the service, open a known bookmark or type its official address yourself.
The visible link and actual destination differ
A button labeled “View event” can lead somewhere unrelated. Microsoft recommends checking the actual destination and, on mobile devices, using a long press to inspect a link before opening it. A matching logo or lock icon does not establish that the destination belongs to the claimed organization.
The invitation creates urgency or financial pressure
“Pay today,” “renew immediately,” “avoid cancellation,” and “confirm within 10 minutes” are classic pressure tactics. Treat requests for card details, bank transfers, gift cards, cryptocurrency, or financial forms as a separate fraud signal. Verify any charge through the provider’s account page or a known billing contact.
It asks you to authorize an unfamiliar app
A legitimate identity-provider screen can still be asking you to grant access to a malicious application. Read the application name, publisher, requested scopes, and account being accessed. If you do not recognize the app or cannot explain why it needs the listed permissions, cancel the request.
Polish is not evidence
High-quality graphics, correct spelling, a realistic meeting title, and a calendar entry that looks official can all be copied. Judge the sender, request, and destination independently, then confirm the event through a contact route you already trust.
How to verify an invitation safely
- Pause. Do not click links, open attachments, download files, enter credentials, send a code, pay, or approve an application while you are still deciding whether the event is genuine.
- Expand the sender details. Check the complete email address, domain, reply-to address, and any organizer information. Compare them with a known address from your contacts or prior correspondence.
- Inspect, don’t follow, the link. On a computer, hover over it; on a phone, long-press it to reveal the destination. If the destination is unexpected, close the preview. Never copy a suspicious URL into a browser just to “see what happens.”
- Use an independent route. Contact the supposed host by replying to an existing conversation, calling a number already in your address book, visiting the organization’s website through a bookmark, or using an internal directory. Do not use the contact details supplied only in the invitation.
- Ask a specific question. Confirm the event title, time, purpose, and exact action requested. A real organizer can verify those details without asking for your password or security code.
- Handle the event only after confirmation. If it is legitimate, use the calendar provider’s normal controls. If it is not, report it and remove it without interacting with its links or attachments.
Google Calendar controls and their limits
Google documents a platform-specific way to handle a suspicious event: “If you notice a suspicious invitation or event on your calendar, report it as spam.” Reporting an event sent from Google Calendar removes it from the calendar; a recurring series is removed as well.
This control does not apply to events created by another provider, app, or service. In those cases, use the reporting and removal features offered by the originating service or your email provider, and consider blocking the sender.
Free tools Windows power users keep installed
One-click scans. No signup required.
Google also documents an invitation setting labeled “Only if the sender is known.” In that setting, “known” includes contacts, people in your organization, and people with whom you have interacted. It can reduce automatic additions from some unfamiliar senders, but it is not a universal phishing filter. Google notes that the setting might reveal to senders that they are not in your contacts. Check the current Calendar help instructions for your account type before changing the option, because controls can differ by edition and may change over time.
What to do with a suspicious invite
If you have not interacted with it
- Leave links, attachments, QR codes, and embedded phone numbers untouched.
- Do not respond with a password, verification code, phone number, payment detail, or identity document.
- Verify the organizer separately, then delete or report the invitation if it is fraudulent.
- Use your email or calendar provider’s phishing or spam-reporting control. Reporting helps the provider analyze the sender and protect other users.
How to report it
The FTC lists several reporting routes: forward phishing emails to [email protected], forward phishing text messages to SPAM (7726), and submit a report at ReportFraud.ftc.gov. Microsoft provides reporting steps for Outlook and Teams. Use the reporting control in the calendar or mail product that delivered the event as well.
If it claims to be from a colleague or organization
Tell the supposed host through a separate, known channel that their name or account is being used. Do not forward the suspicious link to coworkers as a warning unless your organization’s security team requests the original message; forwarding can spread the lure. Preserve the event title, sender address, timestamps, headers, and screenshots needed for an incident report.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you clicked, replied, or shared information
You entered a password
- Change the password immediately from the service’s official site, not from the invitation link.
- Change it anywhere else you reused it. Use a unique password for every account.
- Turn on multifactor authentication. A security key is one possession-factor option, but multifactor authentication does not undo a permission already granted to an application.
- Review recent sign-ins, recovery addresses, forwarding rules, and sent mail for unauthorized changes.
- For a work or school account, contact your IT or security team promptly; administrators may need to revoke sessions, reset tokens, or investigate messages sent from the account.
You shared identity or financial information
Use IdentityTheft.gov for FTC guidance tailored to the information exposed. If you supplied card, bank, payment, or investment details, contact the relevant institution using the number on a statement or card. Ask whether the account should be frozen, replaced, monitored, or placed under additional verification.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →You clicked a link or opened an attachment
If a file may have downloaded or software may have run, update your security software, run a full scan, and follow its removal instructions. Disconnect a device from sensitive services if your security team advises it. Record what you clicked, when it happened, what downloaded, and any warning shown; those details help responders and reporting agencies.
You approved an app permission
Open the account’s security settings directly and review connected applications, third-party access, or authorized apps. Remove the unfamiliar application and revoke its permissions. The FBI’s warning about persistent OAuth access is important here: a password change alone may leave the app’s token active.
You sent money
Contact the bank, card issuer, payment service, or transfer provider immediately and explain that the transaction resulted from a suspected phishing scam. Speed matters because some transfers can be recalled or frozen only within a short window. Preserve receipts, wallet addresses, account numbers, and messages for the provider and law-enforcement report.
Which defenses solve which problem?
| Defense | What it helps detect or prevent | Important limitation |
|---|---|---|
| Confirm the organizer independently | Impersonation before you interact with the event | Use a phone number, directory entry, or existing conversation—not contact details supplied by the invite. |
| Inspect the sender and destination | Lookalike domains, unrelated addresses, and deceptive links | The visible label of a link does not prove where it leads. |
| Calendar invitation controls | Automatic addition of some unexpected events | Behavior differs by provider; Google’s “Only if the sender is known” setting is not a universal control. |
| Multifactor authentication | Login attempts that rely only on a stolen password | It does not remove an application permission already granted. |
| Connected-app review and revocation | OAuth consent phishing after authorization | You must review the account’s security settings; changing the password alone may not revoke the app token. |
| Provider reporting | Flagging the message or event for abuse detection | Reporting does not replace password resets, financial notifications, or malware scanning after exposure. |
How workplaces can reduce calendar-invite risk
Organizations should teach employees that a calendar entry is an untrusted message channel, just like email or text. Training should include sender-domain inspection, independent verification, link previews, and the difference between signing in and granting an application permissions.
Administrators can document where employees report suspicious events, what evidence to preserve, and who handles suspected OAuth grants. A response playbook should cover password resets, session and token revocation, mailbox-rule review, endpoint scanning, and notification of affected contacts. Staff should know that a compromised mailbox may send convincing invitations to coworkers, customers, or family members.
Do not rely on a single setting to block every event. Provider controls may reduce automatic additions, while identity security, application-permission reviews, and user verification address different stages of the attack.
A quick decision checklist
- Was the event expected and discussed before it arrived?
- Does the full sender address match the person or organization named?
- Is the domain spelled correctly and appropriate to the claim?
- Does any link lead to the service you expected?
- Does the event request a password, one-time code, payment, download, or app authorization?
- Can the organizer confirm it through a phone number, directory, or conversation you already trust?
- If you already acted, have you changed reused passwords, notified financial institutions, scanned the device, and revoked unfamiliar app access?
If any answer raises doubt, stop and verify independently. A calendar invitation is only a delivery format; it is not authentication.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
