A Stranger Can Book a Scam Right Onto Your Calendar

The meeting you never agreed to

Check your calendar for a meeting you do not recognize and you may be looking at the newest phishing play in the book. Morning Brew reports that incidents of calendar invite phishing, built on the .ics files that power calendar invites, rose about 33,000 percent between May and September, according to the cybersecurity firm Sublime.

The format is the trick. A normal phishing email has to survive your spam filter and then persuade you to open an attachment. A calendar invite skips both steps. It lands on the calendar you trust, it looks like business, and the dangerous part is simply a link sitting inside a meeting you never asked for.

Three ways the invite tries to get you

Sublime counts three main methods, and each one starts with that link inside the meeting:

• The link opens a form that asks for your login credentials, dressed up to look like a service you already use
• The link prompts a malware download onto your laptop
• The link leads to a meeting with a scammer posing as someone you have reason to trust, like a worker at another company or a potential client

Why people who book strangers get hit first

Morning Brew notes that professionals who often meet with strangers, like salespeople and recruiters, are common targets. Put creators and service businesses in that same bucket. If your living depends on discovery calls, booking pages, and first meetings with people who found you online, a strange name on your calendar is not unusual. It is Tuesday.

There is a newer wrinkle. Sublime found that some of these invites are arriving because AI agents accept invitations on a worker behalf. The assistant that was supposed to save you time can also wave a scam straight past the front door, politely, at scale, while you are busy doing the actual work.

A five minute calendar hygiene check

The fixes are boring, free, and worth doing before your next booking call:

• Check your calendar settings and stop invites from being added automatically before you respond, a step Consumer Affairs recommends
• Treat every link inside an invite like a link inside a cold email, and inspect where it goes before you tap
• Never type login credentials into a page a calendar link sent you to; open the service directly instead
• When a new client books you, confirm the meeting through a channel you already trust, like the email thread or DM where the conversation started
• If an AI agent manages your calendar, set a clear rule that invites from unknown senders get flagged for you, not accepted

The takeaway for small teams

None of this means closing your booking page or vetting every inquiry like a bank loan. It means remembering that your calendar is now an inbox, with the same scams and the same need for a two second pause. The businesses that take meetings for a living cannot afford to treat every invite as friendly. Look first, click second, and let the mystery meeting stay a mystery.