Appointment or renewal reminder appears in victims’ calendar to lure them into logging in to fake Google, Microsoft or PayPal page
You’re preparing for the week ahead and take a look at your Google calendar. There’s an entry for a meeting that you must have completely forgotten. The note that pops up when you click on it says you’ll be reviewing a project and includes a link to more details. Confused, you follow it to find out more; the website you land on asks for logon details, and you provide them.
Unfortunately, this was not a failure of your memory but a calendar phishing scam. You have handed your name and password to fraudsters who will sell it on in a batch with other people’s details, use it to break into your work email, or to persuade you that they are contacting you from your bank, or another institution.
Luke Wescott, a threat detection engineer at Sublime Security, says calendar phishing is still relatively new but the company has seen “exponential growth”.
The scam takes several forms, including a fake meeting, or a prompt to renew a service you pay for. In all, an entry appears in your electronic calendar.
It ends up there after scammers send an email to your work, or personal address, with a calendar request. It doesn’t matter if you miss it, or it ends up in your spam folder.
“Calendar apps, such as Google Calendar, can add invitations automatically without users even accepting them,” Wescott says. “So scammers don’t even need you to open an email.”
And while you may not look twice at one from someone whose name you do not recognise, when something turns up in your calendar you may treat it differently. “It can create a borrowed credibility by showing up in the same place as your dentist appointment or a weekly 1:1 with your boss,” he says.
Max Gannon, an intelligence analysis manager at the cybersecurity company Cofense, says some scammers are using legitimate platforms such as Zoom to send the invitations, making them look more convincing to the recipients, and to security software.
“That makes it really hard to block,” he says. “Even AI-backed blockers struggle.”
If you set up something to filter out invitations from these platforms, he says “that would also block any legitimate meeting invitations”.
What it looks like
You will receive an email and see an entry in your calendar. The titles vary: examples seen by the Guardian include fake meetings, notifications of voicemail messages, and software renewals.
Wescott says this is standard. “We typically see stuff like ‘New voicemail received’, ‘Payment receipt confirmation – $298.99’, ‘PayPal unusual activity’ warnings, ‘Your auto-payment will be processed within 24 hours’, and invitations to bid on a contract,” he says.
Gannon says the invitation could look like it has come from within your company. “If they want to they could make it look like an internal invitation,” he says. “They can customise the content, may be adding the logo of your company.”
The event description will typically contain a link, or a phone number.
Wescott adds: “Either they want you to click a link to a fake login page like Microsoft, Google or PayPal, and enter your password, or to call a ‘support’ number to cancel a charge that never actually happened.”
Until you click on this, or make a call, you are not compromised. The scammers do not have access to everything in your calendar – they are just trying to lure you to a place where you will hand over your details.
As Wescott says, “it sounds familiar to typical phishing, it’s the same technique, just using a different delivery method”.
What to do
Don’t panic if you see an unexpected meeting or reminder in your calendar. Treat it as you would an unexpected email and don’t click on the link.
“My number one advice is people just need to be paranoid,” Gannon says. “It doesn’t matter if the invitation has come from someone two desks down, you’ve got to be suspicious of everything.”
Wescott advises turning off automatic accepting. In Google Calendar you can go into settings and opt to only accept invitations from known senders, or when you have accepted.
He adds: “Don’t click ‘decline’ on suspicious invites as it can tell the sender that your address is ‘live’. Instead, delete or report it as spam/junk.”
