A fake Malwarebytes subscription renewal for $429.99 just appeared in your team's shared calendar. Nobody clicked a link. Nobody opened an attachment. The invoice sits between Tuesday's budget review and Wednesday's project sync, complete with a toll-free number and a three-year renewal period nobody authorized.

This is calendar invite phishing. Scammers exploit auto-add settings in Google Workspace and Outlook to plant fraudulent charges directly into calendars, bypassing email filters entirely. When employees call the number to dispute the charge, attackers apply real-time pressure for payment details or remote access installation.

Your email security stack never sees it. Your spam filters never flag it. The attack lives in a tool your team trusts implicitly.

Why This Matters Now

Phishing campaigns increasingly target calendar systems because auto-add settings treat every invite as legitimate. Google Calendar and Outlook automatically process incoming invites from any sender unless administrators manually disable the feature. Most organizations leave it enabled for collaboration convenience.

Attackers exploit this default by sending calendar invites containing fake subscription receipts. The invites appear alongside genuine meetings, borrowing credibility from the calendar interface itself. Amounts are deliberately large, often several hundred dollars for multi-year renewals, designed to trigger immediate action.

The scam shifts pressure from inbox to voice. Instead of clicking a malicious link, employees call a scam number listed on the fake invoice. Once on the phone, attackers use urgency and authority to extract payment details, install remote access software, or harvest credentials. The live conversation creates psychological pressure that automated phishing emails cannot replicate.

Declining the invite confirms your email address is active, adding you to lists for future phishing campaigns. Deleting without response is the only safe action, but most users lack awareness that calendar invites can be malicious.

Three Strategic Gaps Exposed

Auto-Add Settings Bypass Perimeter Controls

Email gateways scan attachments and links, but calendar invites pass through unchecked. Auto-add processing treats every sender as trusted, placing scam invoices directly into user calendars without review.

• Perimeter security assumes threats arrive via email body or attachments
• Calendar invites exploit collaboration features designed for legitimate scheduling
• No alert triggers when an external sender adds an event to employee calendars
• Users perceive calendar events as pre-vetted because they appear in a trusted interface

Employees Lack Awareness That Calendars Are Attack Vectors

Security training focuses on email links and attachments. Most employees do not realize attackers can inject events into their calendars or that declining an invite validates their email address.

• No mental model exists for calendar-based phishing in most user populations
• Declining invites feels like a safe rejection, not a response that confirms activity
• Fake subscription charges mimic legitimate vendor communications employees expect
• The shift from click-based to call-based social engineering catches users unprepared

Voice Phishing Applies Pressure Email Cannot

Once an employee calls the scam number, attackers control the conversation. Live interaction enables real-time manipulation that automated phishing emails cannot achieve.

• Attackers pose as support agents with authority to resolve the fake charge
• Urgency increases when users believe they are disputing unauthorized billing
• Remote access requests seem reasonable in a troubleshooting context
• No technical controls exist to block a user who voluntarily provides credentials over the phone

The Strategic Shift Required

Securing calendars requires disabling auto-add settings and training employees to treat calendar invites with the same skepticism they apply to email. Google Workspace and Outlook both allow administrators to restrict automatic event processing, forcing users to manually review invites before they appear on calendars.

Multi-factor authentication (MFA) prevents attackers from using compromised credentials to send calendar invites at scale. Restricting calendar permissions to internal or trusted domains limits external senders' ability to inject events. Deleting suspicious invites without declining prevents validation of active email addresses.

Training must expand beyond email to cover calendar-based attacks. Employees need to recognize red flags in fake subscription receipts, understand that declining invites can confirm their email is active, and know that calling numbers listed on unsolicited calendar events is never safe.

• Disable auto-add calendar processing across Google Workspace and Outlook environments
• Restrict calendar invite permissions to internal domains or explicitly trusted external contacts
• Deploy MFA to prevent credential-based abuse of calendar systems
• Train employees to delete suspicious calendar events without responding or declining
• Simulate calendar phishing in Security Awareness Training to build recognition skills

How Security Awareness Training Addresses This

KnowBe4's Security Awareness Training equips employees to identify calendar invite phishing before anyone calls a scam number. Training modules simulate fake subscription receipts planted via calendar invites, teaching users to recognize red flags like unexpected vendors, large amounts, and unsolicited renewal notices.

• Auto-add settings bypass perimeter controls: Training explains how calendar invites exploit default settings and why deleting without response is the only safe action.
• Employees lack awareness that calendars are attack vectors: Simulations expose users to calendar-based phishing in a controlled environment, building mental models for recognizing calendar spam.
• Voice phishing applies pressure email cannot: Training covers the shift from click-based to call-based social engineering, teaching users never to call numbers listed on unsolicited calendar events.

The Phish Alert Button allows employees to report suspicious calendar invites directly from their inbox, creating visibility into emerging calendar phishing campaigns. Phishing Security Tests measure how users respond to simulated calendar scams, identifying teams that need additional training before real attacks arrive.

Who This Is For

• CISOs managing human risk in Google Workspace or Outlook environments with default auto-add settings enabled
• IT Managers responsible for securing collaboration tools and calendar permissions across enterprise users
• Security Engineers deploying MFA and calendar access controls to prevent external abuse
• Compliance Managers tracking user awareness of emerging phishing vectors beyond traditional email threats

Call to Action

Train your team to recognize calendar invite phishing before the next fake subscription charge appears. Visit https://content.optrics.com/knowbe4-security-awareness-training

FAQ

What is calendar invite phishing?
Calendar invite phishing exploits auto-add settings in Google Calendar and Outlook to plant fake subscription receipts or event invites directly into user calendars. Scammers impersonate vendors like Malwarebytes, listing toll-free scam numbers designed to pressure employees into providing payment details or installing remote access software when they call to dispute the charge.

Why do scammers use calendar invites instead of email?
Calendar invites bypass email security filters because they are processed as collaboration requests, not traditional messages. Auto-add settings automatically place invites into calendars without user review, making scam events appear alongside legitimate meetings. The calendar interface lends credibility, and the shift from click-based to call-based phishing applies real-time pressure once employees dial the scam number.

How does Security Awareness Training prevent calendar phishing?
KnowBe4's Security Awareness Training simulates calendar invite phishing, teaching employees to recognize red flags like unsolicited vendor renewals, large amounts, and unexpected calendar events. Training explains why declining invites can confirm active email addresses and why calling numbers on unsolicited calendar events is never safe. The Phishing Security Test measures user response to simulated calendar scams, identifying teams that need reinforcement.

What technical controls reduce calendar phishing risk?
Disabling auto-add processing in Google Workspace and Outlook forces manual review of calendar invites before they appear. Restricting calendar permissions to internal domains or trusted contacts prevents external senders from injecting events. Deploying MFA prevents attackers from using compromised credentials to send calendar invites at scale. Employees should delete suspicious invites without declining to avoid validating their email addresses.