Calendar invitation spam

[Robert Brown (RLBrown)]

Hello SVMUG members and friends,

A scam is appearing with increasing frequency. It uses Google Calendar and the Meet Google invitations, or the Apple Invites feature, but so far, it has occurred with a lot less on Apple Invites. First, you can read about the Google problem, and then continue below for information related to Apple Invites. 

Google Meeting Invitations and Notifications

A notification will appear on your device stating, "$499.95 will be debited from your account," or a similar message. You will see that Google Calendar sent the notification, and a mysterious event has been added to your calendar. This event has a title indicating that a payment is due. When you check the event attendees, it is usually a long list of seemingly random email addresses. 

The scam works by inducing panic and prompting you to join the meeting that was indicated. From there, the scammer will attempt to social engineer you in some fashion. It might be the old claim: "Oh, a mistake has been made. I will reverse it, tell me your bank account details and authorize a 'test' transfer..."

Why this happens

Google Calendar used to assume that invitations were good-faith scheduling attempts, so it allowed unknown senders to place events automatically. Scammers exploited that by embedding frightening financial claims to provoke calls or clicks.

To avoid this from annoying you, you can just change one setting on Google Calendar. Go to:

Google Calendar → Settings (gear icon) → Event settings. Change this setting:

"Automatically add invitations"

Set to: "No, only show invitations to which I have responded"

This prevents random individuals from adding events to your calendar without your consent.

Reference:

https://support.google.com/calendar/answer/6084011

You should also change Gmail settings if you are using Gmail for one or more of your email addresses. (Hey, I have five.)

Still in Google Calendar Settings, scroll to:

Events from Gmail

Uncheck: “Automatically add events from Gmail to my calendar”

(You’ll still see flight/restaurant info in Gmail itself, not calendar-auto-added.)

Reference:

https://support.google.com/calendar/answer/6084011#remove_events_from_gmail

For any notifications you have already received, you can remove and report them as scams.

Click the event

Choose “Report spam” or “Remove”

If offered, choose “Report as spam”

This helps Google detect the sender.

Finally, you may consider these settings. Block the given sender. If you have a shared calendar, ensure that only trusted individuals have access. 

Apple Meeting Invitations and Notifications

Do you know if this happens with Apple Invites? So far, I have not seen it. But it is possible. I have for you here what to do. The mechanics differ from the Google Calendar case

Attackers send calendar invites via iCloud/Apple’s servers that appear legitimate — e.g., from nor...@email.apple.com — so standard filters may not catch them. 

These invitations may contain phishing text in the “Notes” field, fake charges, or links that ask the user to call a number or click a link for “support” or “refund”. 

On iOS/macOS, users are seeing event invite pop-ups or calendar entries they never requested. 

Handling these is straightforward. Don’t click links in unexpected calendar invites. Treat them like phishing emails.

Do you have existing calendar subscriptions that you shouldn't? Maybe because you accidentally clicked an invitation link in the past? You can check for these and delete the unwanted Calendar subscriptions.

You can block the sender email address (if you identified one) in Mail, then delete any invite + corresponding email. Some users report that blocking the sender helped eliminate the spam calendar.

If you use multiple email accounts, make sure Calendar sync is only active for trusted ones.

Report Junk / Spam to Apple.

Keep software patched: iOS, iPadOS, and macOS updates often include security fixes against new exploit vectors.

And finally, would you like me to say it? Make sure your Apple ID has strong security: Use a strong password, enable Two-Factor Authentication, and review trusted devices.

Robert Lawson Brown mail