On the Radar

Scammers can drop fake events straight into your calendar

Posted

PhishingGoogle CalendarMicrosoftPayPal

Scammers are planting fake entries in people’s calendars — a meeting you don’t remember, a “new voicemail”, or a warning that a subscription’s about to renew. The Guardian reports that people are being targeted via calendar apps like Google Calendar, which can add invites automatically — so the event just appears, even if you never opened the email. The entry pushes you to a fake Google, Microsoft or PayPal login page, or to a fake “support” number to cancel a charge that never happened.

The move Don’t tap the link or ring the number, and don’t hit Decline — that tells them your email’s live. Deleting the event can send a decline too, so report it as spam if you can, then open the real app or site yourself to check. In Google Calendar settings, set “Add invitations to my calendar” to “Only if the sender is known”.
Practise it: Would You Click? →
For teachers

Talking about this in class

This is a good example of why “it looked legit” is never proof: the entry borrows trust purely from where it appears, not from anything it actually verifies. A quick discussion prompt — where else does familiar packaging make something feel safe (a padlock icon, a real-looking sender name, a Zoom-branded invite)? The habit worth landing is the same one every time: don’t act from the message, go direct to the real app or site yourself.