Calendar Invite Scams Exploded 1,216% — Here’s How They Work

October 27, 2026

Your calendar might be telling you to attend a meeting you never scheduled, and that appointment could have a criminal agenda. Calendar invite scams surged 1,216% from July to August 2026, according to cybersecurity firm Sublime Security. The attackers exploit something most people rarely question: an ordinary invitation that appears alongside legitimate appointments.

The scam doesn’t necessarily begin with a suspicious email demanding money. Instead, a fake meeting can slip onto your schedule, complete with an official-looking subject line and a link that seems perfectly reasonable. You might spot it while checking tomorrow’s appointments, long after the original message has disappeared into your inbox clutter. That small detail helps explain why these scams deserve attention, even from people who already know how to spot sketchy emails.

The Invitation Can Appear Before You Accept It

Calendar invitations normally make life easier. Someone schedules a meeting, sends an invitation, and your calendar handles the administrative chores. Unfortunately, certain email and calendar settings can also add incoming invitations automatically, depending on the service and your preferences. That means an unfamiliar event might appear before you’ve decided whether the meeting deserves a place on your schedule.

Scammers exploit that convenience with malicious calendar files, often using the .ics format that legitimate scheduling systems recognize. The file can contain ordinary event details alongside a phishing link or other harmful content. Because the invitation uses a legitimate format, its appearance alone doesn’t establish whether it’s safe. And if the associated email gets filtered into spam while the calendar entry remains visible, you could encounter the suspicious event without seeing the original message that explained its arrival.

This creates an awkward little security problem. People routinely inspect their calendars to remember appointments, not to investigate potential fraud. A meeting titled “Account Security Review” might look like something worth checking, particularly during a busy workday. The calendar itself hasn’t necessarily been hacked, and an unfamiliar event doesn’t prove that someone accessed your account. Still, the unexpected appointment deserves scrutiny before you click anything inside it.

The Fake Meeting Usually Wants Something From You

The invitation itself may look harmless. The real danger often appears when you follow its instructions. A fake meeting might send you to a page that imitates Microsoft sign-in, asks you to verify your account, or requests credentials before displaying supposed meeting details. Enter your password, and the scammers may gain information they can use to access your account.

Other campaigns take a more direct route. Sublime documented a malicious invitation that claimed a recipient had a financial document to review. The link led to a website that prompted the recipient to download software attackers had configured for remote access. That technique can expose files, credentials, and other sensitive information, depending on the software and the access it obtains. A supposed invoice or credit note can turn a routine calendar check into a much bigger problem.

Not every suspicious invitation carries malware, either. Some simply try to steal passwords or persuade recipients to call a fraudulent support number. The Federal Trade Commission has also warned about fake party invitations that demand email credentials or verification codes. These schemes share a common goal: persuade you to hand over something valuable before you stop to question the request.

Why Familiar Names Can Fool Careful People

Scammers don’t need to invent a convincing technology company or build an elaborate website from scratch. They can misuse legitimate services to make their invitations look ordinary. Sublime found attackers using familiar calendar infrastructure and free website-building services to deliver malicious links. The result can look polished enough to escape a quick glance, especially when you’re juggling work meetings, school appointments, and reminders to pick up groceries.

The invitation’s subject line often does much of the psychological work. A message about a security review, an unexpected payment, or an urgent document gives you a reason to click. Financial claims can be particularly distracting because nobody wants to overlook a fraudulent charge or miss a payment deadline. Scammers exploit that instinct by making the suspicious link seem like the fastest way to resolve the problem.

Check the sender, the event details, and the destination of every unexpected link. A familiar company logo doesn’t prove legitimacy, and a professional-looking meeting title proves even less. If an invitation claims to come from your employer, bank, or a vendor, verify it through a separate channel you already trust. Don’t use the contact details or sign-in link supplied by the suspicious invitation.

A Few Calendar Settings Can Reduce the Risk

Start by checking how your calendar handles invitations from unfamiliar people. Google Calendar, Outlook, and Apple calendar services offer different controls, and the available settings vary. Look for options that prevent invitations from automatically appearing on your calendar or limit automatic additions to known senders. A little time in settings can reduce the number of suspicious appointments you encounter in the first place.

If a strange event appears, don’t click its links, download its attachments, or reply to the invitation. Check the event’s organizer and verify any legitimate-looking request independently. Report the suspicious message through your email provider’s phishing tools, then remove the event using your calendar’s available reporting and deletion options. If the event keeps returning, review your calendar’s sharing permissions and account security.

Also, enable multifactor authentication on your email account and keep your devices updated. These steps won’t prevent every phishing attempt, but they can make account takeover harder. If you entered your password on a suspicious website, change it promptly through the legitimate service, and change it anywhere else you reused it. Review recent account activity, sign out of unfamiliar sessions where possible, and contact your workplace’s IT team if you used a work account.

Your Calendar Deserves a Little Suspicion

Sublime’s 1,216% figure describes the increase its systems detected from July to August 2026, not a measurement of every calendar scam worldwide. Still, the trend offers a useful warning: familiar digital tools can become delivery routes for fraud.

You don’t need to distrust every meeting invitation or turn scheduling into a forensic investigation. Just give unexpected events the same scrutiny you’d give an unfamiliar email, particularly if they demand passwords, downloads, payment, or urgent action. A calendar entry can tell you when something is scheduled. It cannot tell you whether the person who scheduled it deserves your trust.

Have you spotted a strange meeting on your calendar recently, or do you have a favorite way to keep suspicious invitations out? What tipped you off?