Introduction
Imagine this scenario happens at work: You open your calendar to check the schedule for tomorrow and notice a new appointment that you don’t remember making.
Maybe it’s a payment reminder. Perhaps it’s a meeting invitation from someone you don’t recognize. It might even say you have an overdue invoice that needs immediate attention.
So how did that get there?
Unfortunately, cybercriminals have discovered that our calendars can be just as useful for phishing attacks as our email inboxes. In fact, some scammers are now sending fake calendar invitations that appear alongside your legitimate appointments, hoping you’ll trust the reminder enough to click a link, call a phone number, or provide sensitive information.
Case Study: Calendar Phishing Campaign
In October 2025, the University of California, Berkeley warned students and employees about a phishing campaign involving fraudulent Google Calendar invitations.
The invitations contained misleading subjects and sometimes included links, attachments, or instructions designed to steal personal or financial information.
Some pretended to be invoices or overdue payment notices. Others appeared to come from familiar university email addresses, even when the sender wasn’t who they claimed to be.
The problem? Depending on your calendar settings, these invitations could appear automatically without you accepting them. Suddenly, a suspicious message wasn’t sitting in your spam folder. It’s already in your schedule when you open the app.
Why Would Criminals Target Your Calendar?
Think about how differently we treat emails and calendar reminders. If you receive an unexpected email claiming you owe money, you might immediately become suspicious.
Now imagine opening your calendar and seeing an appointment titled, “Payment Overdue — Immediate Action Required.” It would be much easier to assume that you scheduled the reminder yourself or that it came from a legitimate service.
That’s exactly what makes this type of attack so convincing.
Cybercriminals aren’t necessarily creating an entirely new scam. They’re simply delivering familiar scams somewhere we aren’t accustomed to looking for them.
This technique is sometimes called calendar phishing, or CalPhishing.
Your Calendar Can Accept Invitations Automatically
Many calendar applications offer features that automatically add certain invitations to your schedule. This feature helps guarantee you get coworkers’ meeting requests (and your friends’ invite to a weekend event).
Unfortunately, attackers can exploit those same features.
In September 2025, the University of Maryland warned the community about fake Google Calendar invitations involving cryptocurrency invoices and payment requests. The university explained that simply receiving one of these invitations didn’t mean an account had been compromised, but not to engage with them any further.
What Happens If You Interact With One?
The invitation itself is just the first step in the attack.
A fake payment reminder might include a phone number for disputing a charge. Another event could contain a link to a fraudulent login page. Some invitations may even contain attachments designed to deliver malware.
For example, imagine seeing a calendar reminder claiming your account will be suspended unless you verify your information. You click the link, enter your username and password, and assume you’ve resolved the problem.
Unfortunately, you may have just handed your credentials to a cybercriminal instead.
The attacker didn’t need to break into your account, because the invite convinced you to give them access.
How Can You Protect Yourself?
The good news? A few simple habits can make calendar phishing much less effective.
- Check the organizer. Do you recognize the person or brand that sent the invitation?
- Question unexpected reminders. Don’t assume something is legitimate simply because it appears on your calendar.
- Avoid suspicious links and phone numbers. Contact the company directly using information from its official website.
- Review your calendar settings. Toggle to restrict automatic invitations from unknown senders.
- Report suspicious events. Use your calendar’s spam-reporting features, or notify your IT team if the invitation involves a work account.
Most importantly, remember that a calendar invitation is still a message from somebody else. Treat unexpected requests for payments, passwords, or personal information with the same caution you would use with any other kind of communication!
Conclusion
An unexpected appointment doesn’t mean someone hacked your calendar. It just means that someone sent you a malicious invitation.
We’re accustomed to watching our email inboxes for suspicious messages, but cybercriminals don’t limit their attacks to just email anymore. They also use the everyday tools we trust to organize our lives. So before clicking a link or following instructions inside an unfamiliar calendar event, take a moment to check who sent it and why.
Your calendar is supposed to remind you about important things. Don’t let a scammer use it to remind you to hand over your information.
