TL;DR: On 12 October 2026, Which? warned of a resurgence in scam calendar invites: events that appear in your calendar with a fake payment warning, a "support" number or a meeting link. Responding, even with "Decline," confirms your account is active. Delete them without replying, then change one setting: in Google Calendar set "Add invitations to my calendar" to "Only if the sender is known"; on iPhone delete unknown subscribed calendars; in Outlook turn off automatic adding of events from email. Forward the original email to report@phishing.gov.uk.
What these invites look like
You open your calendar and there’s an event you never made: "Payment of £399 approved, call to cancel," "Your subscription renews today" or a "billing update meeting." According to Malwarebytes, common lures include:
- warnings about an impending payment;
- prompts to call a phone number;
- fake meeting invites, such as a fake "Geek Squad" billing update;
- subject lines with words like investment, invoice, bonus payout or urgent meeting.
The goal is usually money: a fake tech-support call, getting you to install remote-access software, selling you something overpriced, or collecting bank details.
It’s phishing in a smarter costume. People have learned to ignore spam emails, but a calendar alert pops up on your phone like a reminder from your own life.
How they get into your calendar
Malwarebytes says the invites arrive as email attachments or as download links in messaging apps. Many calendar apps add invitations automatically as soon as the email lands, so the event appears before you’ve opened anything. And because calendars sync across devices, one invite can show up on your phone, laptop and watch at once.
Why "Decline" is the wrong button
The Which? alert is clear: responding to the invite confirms to the scammer that your email account is active. "Decline" is still a response; it sends an email back. Delete instead, and in Outlook pick "Do not send a response" if offered.
There’s a second reason. In Google Calendar, replying to an invitation makes the sender "known," so future invitations from them can be added automatically.
How to stop them
Google Calendar (computer)
- Open Google Calendar, click the gear icon, then Settings.
- Under Event settings, change "Add invitations to my calendar" to "Only if the sender is known" or "When I respond to the invitation in email."
- Untick "Show events automatically created by Gmail" if you don’t use that feature.
- Delete the fake events and remove any calendars you don’t recognise.
Android Police reported Google testing "Only if the sender is known" as the new default, replacing "From everyone." Check yours anyway: your account may still be on the old setting.
Android
In the Calendar app, tap Menu > Settings > General > Adding invitations, then choose "Only if the sender is known."
iPhone and iPad
- Open Settings, then Calendar (on newer iOS: Settings, Apps, Calendar).
- Go to Accounts, then Subscribed Calendars.
- Delete anything you didn’t add on purpose.
Spam "subscribed calendars" often come from tapping a pop-up on a dodgy website, so clear your browser history too if they keep coming back. The same sites often show fake virus warnings (how to close those).
Mac
Go to Apple menu > System Settings > Privacy & Security > Calendars and check which apps have access. Remove access for anything you don’t recognise.
Outlook
- Delete the invite without opening links or attachments.
- Choose "Do not send a response" if asked.
- Mark the sender as junk and report it to Microsoft as phishing.
- Turn off automatic adding of events from email in your calendar settings.
- Remove any extra or subscribed calendars you didn’t add.
Delete the event on every synced device, or it can reappear. Malwarebytes says reappearing entries are almost always a sync issue.
If you called the number or joined the "meeting"
- Installed something? Disconnect from the internet, uninstall it and run a security scan.
- Shared card or bank details? Call your bank on the number on your card, or dial 159 to reach your bank’s fraud team.
- Gave remote access? Follow our remote-access scam recovery guide.
- Lost money? Report it: see how to report a scam in the UK.
Forward the original invitation email to report@phishing.gov.uk.
Why your address was targeted
Calendar spam goes to email addresses scraped from breaches and old sign-ups. If you get a lot of it, run a free email exposure check to see which breaches include your address, and consider an email alias for shopping sign-ups.
Frequently Asked Questions
Should I decline a spam calendar invite?
No. Declining sends a reply and confirms your account is active. Delete it without responding.
How do I stop spam invites in Google Calendar?
In Settings, under Event settings, set "Add invitations to my calendar" to "Only if the sender is known."
How do I remove spam calendars on iPhone?
Go to Settings, Calendar, Accounts, Subscribed Calendars and delete the ones you don’t recognise.
Why do deleted spam events keep coming back?
Usually because of syncing. Delete the event or calendar on every device and account where it appears.
Where do I report a scam calendar invite in the UK?
Forward the email to report@phishing.gov.uk.
Sources
- Which?: The latest scam alerts (scam calendar invites, 12 Oct 2026)
- Malwarebytes: Fake calendar invites are spreading, how to remove them
- Android Police: Google Calendar spam protection becomes the default