Calendar phishing scams surge: fraudsters exploit meeting invites to steal login credentials

You're scanning your calendar on a Monday morning, coffee in hand, when you spot a meeting you don't remember scheduling. The title looks plausible—something about a project review. There's a link in the description asking you to click through for details. You do. The page that loads looks official enough, asking for your login credentials. You enter them. Only then does the reality settle in: you've just handed your username and password to criminals who will now sell that information to other fraudsters, use it to break into your work email, or impersonate a bank to manipulate you further.

This is calendar phishing, and it's growing fast. Luke Wescott, a threat detection engineer at Sublime Security, describes the trend as experiencing exponential growth, though the tactic itself remains relatively new to most people. The mechanics are straightforward but effective: scammers send a calendar invitation to your work or personal email address. Unlike traditional phishing emails that you might catch and delete, these invitations often populate your calendar automatically, without requiring you to accept them first. They sit there alongside your dentist appointments and weekly check-ins with your boss, borrowing credibility from their placement among legitimate events.

The invitations take various forms. Some impersonate internal company meetings, complete with your organization's logo. Others pose as urgent alerts—a PayPal warning about unusual activity, a notification that an auto-payment will process within 24 hours, a voicemail message waiting for you, a software renewal notice demanding immediate action. The descriptions typically contain either a link to a fake login page for Google, Microsoft, or PayPal, or a phone number for a fraudulent support line where operators will pressure you to "cancel" charges that never existed.

What makes this attack vector particularly difficult to defend against is how it exploits the trust we place in our calendar systems. Max Gannon, an intelligence analysis manager at Cofense, notes that some scammers are now using legitimate platforms like Zoom to send these invitations, making them appear more credible to both human recipients and security software. Blocking such invitations wholesale would also block genuine meeting requests from those same platforms, creating an impossible choice for security teams. Even artificial intelligence-backed email filters struggle to distinguish the fraudulent from the legitimate when the delivery mechanism itself is trusted infrastructure.

The attack works because it operates on a different channel than email, where most people have developed some skepticism. A calendar entry feels more official, more integrated into your workflow. You're less likely to question it the way you might question an unexpected email from an unknown sender. The scammers are counting on that psychological difference—the same social engineering technique as traditional phishing, just arriving through a different door.

Defense requires a shift in how you think about calendar invitations. Wescott recommends disabling automatic acceptance in Google Calendar, configuring it instead to accept invitations only from known contacts or those you've already accepted from before. More importantly, treat every unexpected calendar entry with the same suspicion you'd apply to an unexpected email. If you see something suspicious, don't click the link. Don't even click decline, Wescott warns, because declining tells the scammer your email address is active and monitored, making you a more valuable target for future attacks. Instead, delete it or report it as spam. Gannon's advice is blunter: "Be paranoid," he says. "It doesn't matter if the invitation looks like it came from someone two desks down. You've got to be suspicious of everything." Until you click that link or call that number, you remain uncompromised. The scammers have no access to your calendar or your accounts. They're simply waiting for you to voluntarily hand over the keys.