PhishingGoogle CalendarMicrosoftPayPal
Scammers are planting fake entries in people’s calendars — a meeting you don’t remember, a “new voicemail”, or a warning that a subscription’s about to renew. The Guardian reports that people are being targeted via calendar apps like Google Calendar, which can add invites automatically — so the event just appears, even if you never opened the email. The entry pushes you to a fake Google, Microsoft or PayPal login page, or to a fake “support” number to cancel a charge that never happened.
The move
Don’t tap the link or ring the number, and don’t hit Decline — that tells them your email’s live. Deleting the event can send a decline too, so report it as spam if you can, then open the real app or site yourself to check. In Google Calendar settings, set “Add invitations to my calendar” to “Only if the sender is known”.
Practise it: Would You Click? →
For teachers
Talking about this in class
An event nobody remembers adding turns up in a student’s calendar: a “voicemail”, a payment receipt, a subscription about to renew. It sits between their real lessons and appointments, so it feels official. Ask the class what makes it feel trustworthy, and whether any of that actually proves anything.
Most will say it looked legit. Push on that: the entry borrows trust from where it appears, just like a padlock icon, a real-looking sender name or a Zoom-branded invite. A good answer names the real tells: nobody expected it, and it’s pushing you to log in or call a number. The habit that works every time: don’t act from the message, open the real app or site yourself.
Swipe to Survive makes a quick starter: students sort scam texts from real ones by the pressure and what each one asks for, whether that’s a fee, a login or a code.
If a student says they’ve already tapped a link and typed in a password or a login code, lead with reassurance: they’re not in trouble and it isn’t their fault. Securing the account is the fix: change that password, and anywhere else they use it, sign out of every other session in the account’s security settings, and turn on two-step verification. If they called a number or handed over card details or a code from their bank, a parent or carer needs to contact the bank too. Then follow your school’s usual route for passing on a concern.