Calendar invites have long been an avenue for scams, but there’s been a surge in these kinds of attacks recently. Whereas people are starting to catch onto fake phishing emails, many aren’t suspicious of unsolicited calendar invites—and cybercriminals are taking advantage.
According to Business Insider, data from security firm Sublime shows that calendar-based phishing attacks increased more than 10x between July and August 2026. Microsoft also reported a sharp rise in such attacks.
Calendar invite attacks are dangerous because you aren’t expecting them and your curiosity gets the better of you. Scammers may send invites to fake meetings and/or insert messages about missed calls, unpaid invoices, or subscriptions that need renewing. The invites can also have malicious links embedded in them, just begging to be clicked.
And that’s the whole point. Scammers want you to open links, call numbers, visit websites. In doing so, you may end up entering your passwords or payment details on imitation sites, or download files laced with malware, or give up personal information to a faker on the other end.
In some cases, fake Google Drive links and AI-generated voices have also been involved to make scam invites seem more credible.
What you should do
One reason this method works is because calendar invites are typically perceived as more legitimate than mere emails. Furthermore, some calendar apps automatically display invites that haven’t been accepted yet.
To minimize your risk of becoming a victim, security experts recommend scrutinizing all unexpected calendar events as carefully as you would unexpected emails. Avoid opening links or calling telephone numbers contained in calendar invites from unknown senders.
It may also be wise to review your calendar app’s settings and change any automatic behaviors for incoming invites.