Phishing
Calendar phishing scam targets Google, Microsoft and PayPal users
A new phishing scam is adding fake meetings to users’ calendars, tricking them into entering their login details on fake Google, Microsoft or PayPal pages.
Ross Grant3 min read
The short version
Scammers are putting fake meetings and reminders into people’s online calendars. These events often include links to fake websites that look like Google, Microsoft or PayPal. If you enter your password, the scammers steal it. This type of scam is becoming more common, so it’s important to check your calendar events carefully.
What happened?
A phishing scam is adding fake meetings and reminders to users’ electronic calendars, including Google and Microsoft. The event descriptions contain links to fake login pages for services like Google, Microsoft or PayPal. The scam is reported to be growing quickly, according to The Guardian.
How the scam works
According to The Guardian (opens in a new tab), scammers are sending out calendar invitations that appear in users’ electronic calendars, such as Google Calendar. These invitations can look like meeting reminders, service renewals, or voicemail notifications. The event description usually contains a link or a phone number. If a user clicks the link, they are taken to a fake login page for services like Google, Microsoft or PayPal. Entering credentials here gives them directly to the attackers.
The scam is effective because many calendar apps, including Google Calendar, can add invitations automatically, even if the user never opens the invitation email. This means a malicious event can appear in your calendar without any action on your part. The event may look legitimate, borrowing credibility by sitting alongside real appointments and reminders.
What makes this scam convincing
The invitations can be customised to look like they come from inside your company, sometimes even including your company logo. Scammers also use legitimate platforms such as Zoom to send the invitations, making them harder for security systems to block. Titles seen in these scams include “New voicemail received”, “Payment receipt confirmation”, “PayPal unusual activity”, and “Your auto-payment will be processed within 24 hours”.
Because these events show up in the same place as your real meetings, people are more likely to trust them. Security experts quoted by The Guardian say this is a form of social engineering, tricking people by making something look familiar and trustworthy.
What to do if you see a suspicious calendar event
If you find a meeting or reminder in your calendar that you do not recognise, do not click on any links or call any numbers listed in the event. Treat it as you would a suspicious email. Experts recommend turning off automatic acceptance of calendar invitations. In Google Calendar, you can change your settings to only accept invitations from known senders or only after you have accepted them manually.
Do not click “decline” on suspicious invites, as this can tell the sender your address is active. Instead, delete the event or report it as spam or junk.
Why this scam is growing
Threat detection engineers say calendar phishing is still relatively new but is growing quickly. Attackers are taking advantage of features in popular calendar apps that were designed for convenience. Because the scam uses trusted platforms and can look like it comes from inside your organisation, it is difficult for both users and security software to spot.
Practical advice for users and organisations
- Be cautious with unexpected calendar events, even if they look legitimate.
- Adjust your calendar settings to limit automatic invitations.
- Educate staff about this type of phishing, especially in organisations that use Google or Microsoft services.
- If you think you have entered your credentials on a suspicious site, change your password immediately and enable two-factor authentication if possible.
Security professionals should review calendar invitation policies and consider user training to help staff recognise and report suspicious events.
Claimed vs confirmed
- Unconfirmed
Calendar phishing scams are growing exponentially.
Reported by The Guardian, quoting security experts, but not confirmed by vendors or authorities.
- Confirmed
Scammers are using fake calendar events to steal Google, Microsoft or PayPal credentials.
Described in detail by The Guardian, with examples from security researchers.
The impact
- Money
- If user credentials are stolen, attackers could access accounts and cause financial loss. Under UK GDPR, companies could face fines up to £17.5m or 4% of global turnover if found negligent in protecting user data.
- Reputation
- Calendar phishing can damage trust in widely used services like Google and Microsoft, especially if users feel their accounts are not secure.
- Customers
- Users risk having their accounts compromised if they enter credentials on a fake site. They should delete suspicious calendar events and change passwords if they suspect compromise.
Why it matters
Anyone using an online calendar, especially Google or Microsoft, could be targeted. If someone enters their login details on a fake site, attackers can steal their accounts or use their information for further scams. This method is harder to spot than traditional phishing emails.
How does it work?
Scammers send calendar invitations by email. Some calendar apps add these events automatically, even if the invitation is not accepted. The event contains a link to a fake login page. If the user enters their credentials, attackers steal them.
Key points
- Phishing scams now target calendar apps like Google and Microsoft.
- Fake events can appear automatically, even if you do not accept the invitation.
- Links in these events lead to fake login pages for Google, Microsoft or PayPal.
- Do not click on suspicious calendar events; delete or report them as spam.
- Adjust calendar settings to limit automatic invitations from unknown senders.
Sources
The Guardian
Reference
