Calendar phishing scams now show up next to your real meetings

According to Guardian News and Media, a scam called calendar phishing is growing fast, and it works by putting a fake entry straight into Google Calendar, next to a dentist appointment or a weekly meeting with a boss.

The scam starts with an email sent to a work or personal address, carrying a calendar request. The person never has to open that email. Google Calendar and similar apps can add the invitation automatically, without anyone accepting it. An entry simply appears. It might be a fake meeting about a project. It might be a notice that a subscription is about to renew. It might look like a PayPal warning about unusual activity, or a voicemail notification, or a payment receipt for a specific amount. Luke Wescott, a threat detection engineer at Sublime Security, lists examples his company has seen: 'New voicemail received', 'Payment receipt confirmation – $298.99', 'PayPal unusual activity' warnings, 'Your auto-payment will be processed within 24 hours', and invitations to bid on a contract.

Why the calendar is the trick

An email from an unfamiliar sender gets a second look from most people. An entry sitting inside a calendar app does not get the same scrutiny, because it arrives somewhere that already holds real appointments. Wescott calls this borrowed credibility: the fake entry sits in the same place as a genuine 1:1, and that placement does the persuading before the content does.

The scam depends on a gap between where filtering happens and where trust happens. Spam filters watch inboxes. Calendars sit downstream of that filtering, and an invitation can reach the calendar even if the email that triggered it never reaches the inbox at all, or lands in spam and is ignored. Max Gannon, an intelligence analysis manager at Cofense, says some scammers now send these invitations through legitimate platforms such as Zoom, which makes the entry look more convincing to the person who sees it and harder for security software to catch. “That makes it really hard to block,” Gannon says. “Even AI-backed blockers struggle.” Gannon also notes that blocking invitations from those platforms outright would knock out legitimate meeting invites along with the fake ones, so the usual fix of filtering by sender does not work cleanly here.

The entry itself is the website a reader lands on when they click for more detail; that page asks for a login. Handing over a password at that point gives scammers a credential they can sell alongside other people's details, use to break into a work email account, or use to pose as a bank or another institution later.

What this shows

The scam does not need anyone to read an email, click a link in an inbox, or fall for a sender's name. It only needs a calendar app's auto-add setting left on. That single setting is the step the whole scam depends on, and it sits quietly in account settings long after anyone thinks about it.

This is the kind of pattern Flggd tracks: a feature built for convenience, quietly repurposed as the delivery mechanism for a scam.