Calendar phishing scam growing exponentially, security researchers warn

Scammers are placing fake meeting invitations and service renewal reminders in people's electronic calendars to trick them into handing over login details, according to a report published by the Guardian on 11 October 2026¹. Luke Wescott, a threat detection engineer at Sublime Security, said calendar phishing is still relatively new but that the company has seen "exponential growth"¹.

The entries appear after scammers send an email to a work or personal address containing a calendar request, the report says. It does not matter if the recipient misses the email or it lands in a spam folder, because calendar apps such as Google Calendar can add invitations automatically without users accepting them¹. Wescott said this means "scammers don't even need you to open an email"¹.

The scam takes several forms, including a fake meeting or a prompt to renew a service the recipient pays for¹. Wescott listed examples seen by Sublime Security: "New voicemail received", "Payment receipt confirmation - $298.99", "PayPal unusual activity" warnings, "Your auto-payment will be processed within 24 hours", and invitations to bid on a contract¹. The event description typically contains a link or a phone number¹.

Max Gannon, an intelligence analysis manager at the cybersecurity company Cofense, said some scammers use legitimate platforms such as Zoom to send the invitations, making them look more convincing to recipients and to security software¹. He said that makes the invitations "really hard to block", adding that "even AI-backed blockers struggle", and that filtering out invitations from those platforms "would also block any legitimate meeting invitations"¹. Gannon also said an invitation could be made to look like an internal one, with the sender customising the content and possibly adding the recipient's company logo¹.

The report states that until a recipient clicks the link or makes the call, they are not compromised, and that scammers do not have access to everything in the calendar. The aim is to lure people to a place where they hand over their details¹. Wescott said the technique is the same as typical phishing, "just using a different delivery method"¹.

Why it matters for households

Anyone with a calendar that accepts invitations automatically can receive one of these entries, whether the address targeted is a work or personal account¹. The practical risk is credential theft: the report says a victim who enters details on a fake login page has handed their name and password to fraudsters, who may sell it on in a batch with other people's details, use it to break into a work email, or use it to pose as a bank or another institution¹. The report notes that the calendar entries themselves do not give scammers access to the contents of a calendar¹.

The report says people should not panic on seeing an unexpected meeting or reminder, and should treat it as they would an unexpected email¹. Gannon said his "number one advice" is that people "just need to be paranoid", and that it does not matter if an invitation appears to come from someone two desks away¹. Wescott advised turning off automatic accepting, noting that in Google Calendar settings users can opt to accept invitations only from known senders or only when they have accepted¹. He also said not to click "decline" on a suspicious invite, because that can tell the sender the address is "live", and to delete or report it as spam or junk instead¹.

What happens next

No further action, regulatory response or change of policy is reported. The report gives no figures for the number of victims or the value of losses, and no date for when the growth in calendar phishing began¹. Consumers who want general background on reporting and avoiding fraud can read our guide to scams and fraud.