TLDR: Calendar phishing is an attack where a criminal sends a meeting invite that lands on your calendar automatically, then uses the event details, the location field, and the reminder pop-ups to push a malicious link in front of you. It works because invites often slip past the filters that catch ordinary phishing email, and because a reminder on your own calendar feels like an internal task rather than a message from a stranger. Most of it can be shut down by turning off automatic invite acceptance in Google Workspace or Microsoft 365, restricting invites from unknown senders, and teaching staff to treat unexpected events as suspicious. A managed IT provider can apply those settings across every account so protection does not depend on each employee remembering.
An employee opens her calendar on Monday morning and sees a meeting she never accepted. The title reads "Payroll Verification Required," it is scheduled for 9:15 that day, and the description contains a link asking her to confirm her direct deposit details before the deadline. She did not get an email about it. It simply appeared on her schedule, with a reminder already set.
That is calendar phishing, and it is one of the quieter problems showing up in small and mid-sized businesses right now. Attackers figured out that most companies spend their security budget filtering email while leaving the calendar wide open. A meeting invite carries the same payload as a phishing email, but it arrives through a channel employees rarely question, and it gets a second and third chance to be clicked every time a reminder fires.
At Inland Productivity Solutions, we help business owners across the Inland Empire close gaps like this one before they turn into a wire transfer that cannot be recalled or a set of stolen credentials. The good news is that calendar phishing is highly preventable with a handful of settings changes and a short conversation with your staff.
How Calendar Phishing Actually Works
Calendar systems were built on the assumption that invites are welcome. When someone sends you a meeting request, Google Calendar and Microsoft Outlook have historically added it to your schedule right away so you would not miss it while the email sat unread. That convenience is the entire attack surface.
An attacker only needs a valid email address. They create an event, paste a malicious link into the description or the location field, add your address as a guest, and send. Depending on your settings, the event lands on your calendar whether you responded or not. From there the attack has several advantages over a normal phishing email.
➀ It skips most email filtering
Security gateways are tuned to inspect message bodies and attachments. A calendar invite is processed as a scheduling object, so the link inside the event description often reaches the user without the same level of inspection.
➁ It borrows your calendar's credibility
People trust what is on their own schedule. An event that shows up next to a real staff meeting reads as internal business, not as an unsolicited message.
➂ It repeats itself
A phishing email gets deleted once. A recurring event with reminders puts the same link in front of the same person every day until someone removes it.
➃ It creates artificial urgency for free
A meeting has a start time. That built-in deadline pushes people to act quickly, which is exactly what every social engineering attack depends on.
Why This Issue Matters for Businesses
The cost of a successful calendar phishing attempt is the same as any other credential theft or payment fraud. An employee enters her Microsoft 365 password on a fake login page, and within hours the attacker is reading her mailbox, watching invoice conversations, and waiting for the right moment to redirect a payment.
Smaller companies feel this harder than large ones. A business with fifteen people usually has one person handling accounts payable, one person handling payroll, and no second set of eyes on either. When that single account is compromised, there is no internal check to catch it.
There is also a productivity cost that owners underestimate. Once spam invites start arriving, calendars fill with junk events, staff stop trusting their own schedules, and someone ends up spending an afternoon cleaning up entries one at a time. Sound managed IT services prevent the cleanup work as much as the breach.
A Real Business Scenario
A twelve-person property management company in the Inland Empire started seeing meeting invites titled "Vendor Payment Confirmation" on several employee calendars. The invites came from an address that looked close to a real vendor they used, with one letter changed. Each event contained a link to what appeared to be a document portal.
Two employees ignored the events. A third, working through a busy billing week, clicked the link from a phone reminder at 7:00 in the morning and entered her email password on a page that looked exactly like the company sign-in screen. The attacker used that access to monitor her mailbox for nine days, then sent a payment update to a client from her real account. The client paid to the wrong bank account, and the company absorbed the loss to keep the relationship.
Nothing in that story required advanced hacking. It required one open calendar setting and one busy morning.
Common Mistakes Companies Make
➀ Leaving automatic invite acceptance turned on
Default settings in both Google Workspace and Microsoft 365 have historically favored convenience. Most businesses never revisit them after the accounts are created.
➁ Assuming the spam filter covers everything
Email security and calendar security are handled by different parts of the platform. Strong mail filtering does not automatically mean strong invite filtering.
➂ Treating calendar spam as an annoyance rather than a threat
Junk invites are usually the first sign that an address has been added to a target list. The next attempt is often more targeted.
➃ Training staff only on email
Security awareness sessions cover suspicious attachments and fake invoices, then stop. Employees are left with no rule for what to do when a strange event appears on their schedule.
➄ Never reviewing settings after onboarding a new hire
New accounts get created with defaults. Without a checklist, every new employee reopens the same gap the company already closed once.
How to Stop Calendar Phishing at Your Business
The fixes are straightforward and mostly free. The work is in applying them consistently across every account rather than only the accounts of people who complained.
➀ Turn off automatic invite acceptance
In Google Calendar, open Settings, find Event settings, and set "Automatically add invitations" to "No, only show invitations to which I have responded." In Outlook and Microsoft 365, adjust the calendar processing rules so invites from outside the organization require a response instead of appearing on the schedule.
➁ Limit who can put events on a calendar
Google Workspace administrators can restrict invitations from senders outside the organization or from senders not in a user's contacts. This single change removes most bulk calendar spam.
➂ Require multifactor authentication on every account
If a password is stolen, multifactor authentication is what keeps the attacker out. It is the highest value control available to a small business and costs nothing on most business plans.
➃ Enable link protection at the platform level
Services that rewrite and scan links at click time catch some malicious destinations even after a user clicks. Make sure that protection is applied to calendar content and not just to mail.
➄ Give employees one simple rule
If a meeting appears that you did not accept, do not click anything inside it. Report it, then delete it. Clear rules beat long policies that nobody reads.
➅ Write the settings into your onboarding checklist
Every new account should be created with the same calendar restrictions already in place, verified by whoever sets up the account.
Businesses that want these controls applied and monitored across the whole company usually handle it through cybersecurity support services rather than leaving it to individual employees.
What to Do When Someone Already Clicked
Speed matters more than blame. The first hour determines whether this is an incident or a scare.
➀ Reset the password immediately
Change it from a different device, not the one that may be compromised.
➁ Sign out every active session
Both Google Workspace and Microsoft 365 let an administrator revoke all sessions for a user, which cuts off an attacker who is already signed in.
➂ Check mailbox rules
Attackers often create hidden forwarding or delete rules so the owner never sees replies. Look for rules the employee did not create.
➃ Verify any pending payments by phone
Call the vendor or client using a number you already have on file, never a number listed in a recent email.
➄ Tell your IT provider the same day
A short call to IT helpdesk support at the first sign of trouble is far cheaper than a forensic review two weeks later.
Frequently Asked Questions
Can someone add an event to my calendar without my permission? In many default configurations, yes. Anyone who knows your email address can send an invite, and if automatic acceptance is enabled the event appears on your schedule before you ever see a notification. Changing that setting is the single most effective fix.
Is calendar phishing a problem in both Google Workspace and Microsoft 365? Both platforms are targeted. The specific settings differ, but the attack method and the defenses are the same: restrict who can place events on a calendar, require a response before an invite is added, and protect accounts with multifactor authentication.
Does deleting the event remove the risk? Deleting the event removes the link from view, which is the main thing. Be careful with the "decline" option on spam invites, since responding confirms to the sender that the address is active. Delete without responding when you can, and report the sender.
How much does it cost to protect against this? The core protections are configuration changes included in business subscriptions you already pay for, so the direct cost is close to zero. The real cost is the time to apply them correctly across every account and to keep them applied as staff change.
How long does it take to lock this down? For most businesses under 100 employees, an administrator can apply the calendar and authentication settings in a single afternoon. Staff training takes about fifteen minutes and works best as part of a broader security awareness routine.
Should employees report every strange invite? Yes. Reporting is free and gives you early warning that your domain is being targeted. A pattern of similar invites across several employees usually means a larger attempt is coming.
Closing the Calendar Gap in Your Security Plan
Calendar phishing succeeds for one reason: it targets a tool that businesses never thought to secure. The attack itself is not sophisticated, the payload is an ordinary malicious link, and the defense is a short list of settings that most companies simply have not reviewed since the day their accounts were created.
Treat the calendar as part of your security perimeter, the same way you treat email and file storage. Turn off automatic invite acceptance, restrict outside senders, require multifactor authentication, give your team one clear rule for unexpected events, and check those settings whenever someone new joins.
If you are not certain whether your calendar and email settings are protecting your team from calendar phishing, contact Inland Productivity Solutions today for a review of your Microsoft 365 or Google Workspace environment and a practical plan to close the gaps before they cost you money.
