How to Stop Unknown Calendar Invites – From Sales Spam and Phishing Attempts

It’s Wednesday and you open your calendar and see there is a 15-minute “Quick Sync” at 2pm with someone you’ve never heard of. Or worse, an invite from a stranger titled “Bid Notice” or “Grant agreement termination notice,” complete with a link to the “document”. 

Unfortunately, unsolicited calendar invites are on the rise, and they come in two flavors: annoying and dangerous. Here’s how to tell them apart and how to make both stop.

Flavor one: the sales invite

Some outbound sales teams have started skipping the cold call or cold email and going straight to your calendar, betting that a meeting already on your schedule is harder to ignore than a message in your inbox. While probably not malicious, it can feel presumptuous, a little invasive and probably annoying. 

Flavor two: the phishing invite

Over the past few weeks, our security team has seen a sharp increase in calendar invite phishing across the teams we support. These invites land in your inbox or directly on your calendar and contain a link to a “recording,” “voicemail,” or “PDF.” If you click it, you’re taken to a fake login page designed to capture your credentials, or to a malware download. 

Subject lines we’ve seen include:

• “You received a new voicemail message”
• “Bid invite”
• “Grant agreement termination notice”

Attackers know what makes mission-driven teams act quickly. And we can expect the wording to keep evolving.

Calendar phishing works because it sidesteps our instincts. We’ve been trained to be suspicious of emails and unknown callers, but a calendar event feels like it came from inside the house.

If you get one: what to do

Don’t click any links in the invite, and don’t RSVP, don’t even decline. Responding can confirm to the sender that your address is active. Instead, mark it as spam or phishing from your inbox (if you work with an IT team, forward it to them so they can block the sender), then delete the event from your calendar.

And as a general rule: always check the URL in your browser’s address bar before entering a password or 2FA code. If it isn’t the real login page for your account, immediately close the tab.

The 60-second fix for Google Calendar

The good news is that one setting stops both flavors from landing on your calendar automatically.

1. Open Google Calendar and click the gear icon to go to Settings.
2. Select Event settings.
3. Find Add invitations to my calendar and change it from Everyone to Only if the sender is known.

With this on, invites will only appear on your calendar automatically if the sender is in your contacts or you’ve interacted with them before. Everything else goes to your email inbox, and it only gets added to your calendar once you accept it there. One thing to know: legitimate invites from new people, like a first meeting with a funder or a new coalition partner, will also go to your inbox first. Just accept from email and you’re set.

Security that moves as fast as the threats

We take organizational and business cybersecurity very seriously at Personified. Escalated security issues get a near-immediate response from our team. Beyond security, we serve as a full IT department for mission-driven teams, handling everything from day-to-day support and device logistics to responsible AI adoption and compliance planning.

We’re proud to partner with 125+ impactful organizations, and we’re always glad to welcome new client partners. If your team could use IT support or guidance, let’s connect!