‘You have a meeting’: the calendar phishing scam growing exponentially

You’re preparing for the week ahead and take a look at your Google calendar. There’s an entry for a meeting that you must have completely forgotten. The note that pops up when you click on it says you’ll be reviewing a project and includes a link to more details.

Confused, you follow it to find out more; the website you land on asks for logon details, and you provide them. Unfortunately, this was not a failure of your memory but a calendar phishing scam. You have handed your name and password to fraudsters who will sell it on in a batch with other people’s details, use it to break into your work email, or to persuade you that they are contacting you from your bank, or another institution.

Luke Wescott, a threat detection engineer at Sublime Security, says calendar phishing is still relatively new but the company has seen “exponential growth”. The scam takes several forms, including a fake meeting, or a prompt to renew a service you pay for. In all, an entry appears in your electronic calendar.

It ends up there after scammers send an email to your work, or personal address, with a calendar request. It doesn’t matter if you miss it, or it ends up in your spam folder. Max Gannon, an intelligence analysis manager at the cybersecurity company Cofense, says some scammers are using legitimate platforms such as Zoom to send the invitations, making them look more convincing to the recipients, and to security software.

You will receive an email and see an entry in your calendar. The titles vary: examples seen by the Guardian include fake meetings, notifications of voicemail messages, and software renewals. Wescott says this is standard.

Gannon says the invitation could look like it has come from within your company. Wescott adds: “Either they want you to click a link to a fake login page like Microsoft, Google or PayPal, and enter your password, or to call a ‘support’ number to cancel a charge that never actually happened.” Until you click on this, or make a call, you are not compromised. The scammers do not have access to everything in your calendar – they are just trying to lure you to a place where you will hand over your details.