What is calendar phishing?

Phishing delivered as a calendar invitation: a fake voicemail, document or payment notice inside an invite that links to a sign-in page or another trap. Because calendars can add invitations automatically, the event can appear even when the email that carried it was filtered.

Should I decline a suspicious calendar invite?

No. Any response, accept or decline, sends a notification to the organiser, and CISA advises not to reply to suspected phishing. Report it as phishing or spam and delete it instead.

How do I stop spam invites in Google Calendar?

In Calendar settings, under Event settings, set Add invitations to my calendar to Only if the sender is known, or to When I respond to the invitation in email. Google Workspace admins can set the same limit for their organisation. To remove one, open the event and choose Report as spam.

How do I report a phishing invite in Outlook?

Select the message and use Report, then Report phishing. Then delete the event from your calendar. If the sender is a real organisation, tell it through the contact details on its own website.

The fake voicemail invite: how calendar phishing works, and what to do

Why attackers use calendar invites

They can skip the inbox. Calendars can add invitations automatically, so the event can sit in your day even if the email that carried it was caught or never read. Google’s June 2026 fraud and scams advisory describes “calendar phishing” used to get past filters.
They look routine. A voicemail notice, a shared document, an invoice or a meeting update looks like something a calendar would normally show.
They borrow trust. The invite may come from a real person at a real organisation whose account has been taken over, so the name is familiar even when the message is not.

The signs

An invite you did not expect, often for an odd time or all day.
A voicemail, document, payment or password notice inside the invite, rather than in the service that would normally send it.
A link to a web address you do not recognise, or one that imitates a known brand.
Urgency: listen now, confirm now, your access will expire.

What to do

Do not clickNot the link, not an attachment, not a phone number in the invite.
Do not accept or declineAny response sends a notification back to the organiser. CISA’s advice for suspected phishing is not to reply.
Report itIn Google Calendar, open the event, choose More actions, then Report as spam (this works for invites sent from Google Calendar, and removes the event). In Outlook, use Report, then Report phishing on the message.
Delete itFrom your calendar as well as your inbox, if it is still there.
Tell the sender’s organisationIf the invite came from a real company’s account, contact the company through the phone number or address on its own website, not by replying to the invite.
If you clickedChange the password for that account from a device you trust, sign out other sessions, and tell your IT team or provider.

For administrators

Google Workspace. Since August 2026 admins can cap how invitations are added to users’ calendars (Admin console > Apps > Google Workspace > Calendar > Advanced settings), for example to invitations from known senders only. Users can choose the same in Calendar settings under “Add invitations to my calendar”.
Outlook. Classic Outlook processes meeting requests automatically by default (File > Options > Mail > Tracking). Exchange Online’s calendar-processing settings apply to resource mailboxes such as rooms, not to ordinary user mailboxes, so for users the controls are the mail filter and reporting.
Block and look. Block the linked domain at the mail and web filter, and check sign-in logs for the accounts that received the invite.
Phishing-resistant sign-in. CISA calls phishing-resistant multi-factor authentication, such as FIDO security keys, the gold standard. A stolen password alone then does not open the account.

Questions people ask

What is calendar phishing?: Phishing delivered as a calendar invitation: a fake voicemail, document or payment notice inside an invite that links to a sign-in page or another trap. Because calendars can add invitations automatically, the event can appear even when the email that carried it was filtered.
Should I decline a suspicious calendar invite?: No. Any response, accept or decline, sends a notification to the organiser, and CISA advises not to reply to suspected phishing. Report it as phishing or spam and delete it instead.
How do I stop spam invites in Google Calendar?: In Calendar settings, under Event settings, set Add invitations to my calendar to Only if the sender is known, or to When I respond to the invitation in email. Google Workspace admins can set the same limit for their organisation. To remove one, open the event and choose Report as spam.
How do I report a phishing invite in Outlook?: Select the message and use Report, then Report phishing. Then delete the event from your calendar. If the sender is a real organisation, tell it through the contact details on its own website.

Sources

Google Calendar Help, Add invitations to my calendar, and Report spam in Google Calendar, read 13 October 2026.
Google Workspace Admin Help, automatically add events to calendars, last updated 9 October 2026; Google Workspace Updates, new admin controls for adding invitations, 14 August 2026.
Google, Our latest fraud and scams advisory, 8 June 2026.
Microsoft Support, Phishing and suspicious behaviour in Outlook; Change how Outlook processes meeting responses; Set-CalendarProcessing, updated 16 May 2026.
CISA, Teach Employees to Avoid Phishing, and Recognize and Report Phishing (archived), read 13 October 2026.
CISA, Implementing Phishing-Resistant MFA, October 2022.

General information, not legal advice. BSJ Ventures publishes methods; it never publishes clients, cases or verdicts, and it claims no relationship with any agency, company or maker named here.

← All field notes

The fake voicemail invite: how calendar phishing works, and what to do.