Stop calendar invite spam and spot the scam links inside

This guide stops strangers from putting events straight into your calendar, clears out the spam that is already there, and shows you how to recognise a scam invite before you tap anything. It covers Google Calendar, Apple Calendar and iCloud, and Outlook, and takes about 15 to 20 minutes.

Why bother

Calendar invites are a back door around your spam filter. The email that carries the invite is often sent by Google's or Apple's own servers, so it passes the authenticity checks (SPF, DKIM, DMARC) that filters rely on. Many calendar apps then add the event automatically, so the scam sits in your schedule and pops up as a reminder from an app you trust.

In December 2024 Check Point reported about 4,000 spoofed Google Calendar invites in four weeks, leading to fake "verify you're human" pages asking for payment details. In September 2025, invites sent through Apple's iCloud servers carried a fake PayPal charge and a phone number to "dispute" it.

Before you start

• Time: 15 to 20 minutes.
• You need: your phone, and ideally a computer or tablet (some iCloud and Google settings are easiest, or only available, on the web).
• Checked on: Google Calendar on the web and the Android and iPhone apps (Google Help pages as of November 2026), iOS 26, iCloud.com Calendar, and Outlook on the web / new Outlook. Menu names can differ on older versions or in other languages.
• Work or school accounts: if your calendar is run by an employer or school, some of these options may be locked by an admin. Report the spam to your IT team instead.

Steps

1 Learn the tells before you touch anything

Most of the protection here is knowing what a scam invite looks like. Treat an invite as suspicious if it shows any of these:

• You never agreed to it. A meeting with a stranger, a "payment review", an "account suspended" notice, a prize, or a crypto "withdrawal" that nobody discussed with you.
• The organiser is unknown or odd. A random Gmail or Outlook address, a long string of letters, or a company name that does not match the email domain.
• There is a huge guest list of strangers, or the guests are hidden.
• The urgency is in the notes. "Final notice", "charge of $599", "call within 24 hours", "confirm your wallet".
• There is a link, QR code, attachment or phone number asking you to "verify", "complete a captcha", "claim" or "cancel the order".
• It comes "from" Google or Apple. That only means it was sent through their calendar system. Anyone can create an event.

If an invite claims to be from a company you deal with, ignore every link and number in it. Open the company's app or type its address yourself and check your account there.

2 Google Calendar: only accept invites from known senders

This is the most important switch for Gmail and Google accounts. It also covers Samsung Calendar and other apps that show your Google calendar, because the setting lives in your Google account.

On a computer (web):

1. Go to calendar.google.com and sign in.
2. Click the gear icon at the top right, then Settings.
3. On the left, under General, click Event settings.
4. Under Add invitations to my calendar, choose Only if the sender is known. For the strictest option, choose When I respond to the invitation in email.

On Android or iPhone (Google Calendar app):

1. Open Google Calendar and tap Menu (three lines, top left), then Settings.
2. Tap General, then Adding invitations, then Add invitations to my calendar.
3. Choose Only if the sender is known.

What you should see: the chosen option is shown under Add invitations to my calendar. From now on, invites from people who are not in your contacts, not in your organisation and not someone you have dealt with before arrive only as an email. They no longer appear in your calendar on their own.

The change only affects new invites (Step 4 handles old ones), and Google notes it may reveal to a sender that they are not in your contacts.