I am often the person friends ring after they have clicked something suspicious. Here is one worth warning them about before they do.
The newest phishing trick is not necessarily in your inbox. It is sitting in your calendar, beside your dentist appointment, your work meeting and the birthday reminder you put there yourself.
It may say you have a meeting. Or that a subscription is about to renew. Or that there is a voicemail waiting. It will often contain a link for “details”, a button to make a payment, or a phone number to call.
That is the trick. A calendar entry borrows credibility from its surroundings. We have learned, more or less, to be suspicious of a strange email. But an item that appears among the ordinary machinery of the week can feel as though it has already been checked for us.
According to recent reporting in The Guardian, scammers send calendar invitations to work or personal addresses. Depending on the calendar settings, an invitation can appear without the recipient accepting it. The aim is still familiar: get someone to a fake Google, Microsoft or PayPal sign-in page, or persuade them to ring a bogus support number and hand over personal or payment details.
The important reassurance is that an unexpected entry does not mean that someone has broken into your calendar. It is an invitation, not proof of access. The danger begins when you follow its link, call its number or enter details on the page it opens.
Treat an unexpected calendar item exactly as you would a suspicious email:
do not use the link or phone number in the invitation;
do not enter a password after arriving at a page from an unexpected reminder;
if you think there may be a genuine issue with Google, Microsoft, PayPal or another service, open its app or type its known address yourself;
delete or report the invitation through your calendar or email service rather than replying to it; and
if it arrives in a work calendar, tell your IT or security team.
Google’s Calendar Help confirms that users can control which invitations are added to their calendars, although work and school accounts may be governed by an administrator. It is worth checking those settings now, before an unexpected “renewal” arrives on a morning when you are busy and half looking at the day ahead.
A calendar is supposed to remind us what we decided to do. It should not be allowed to decide whom we trust.