Nestled on your calendar between a 1:30 p.m. lunch and a 2:30 p.m. phone call sits an appointment you weren’t expecting. You didn’t create it, and you certainly didn’t accept an invitation for it, but there it is: “$$$ Playmate Wanted $$$.”
Congratulations, you’ve been hit with Calendar spam.
Calendar services from Google, Microsoft, and Apple are susceptible by default to having appointments placed on them without user permission, says security expert Bryan Seely. He cautions users who encounter calendar spam against clicking on any of the links embedded in the appointment notice or invitation.
“Calendar spam is trying to trick you to click on something stupid. I haven’t heard of many of them resulting in ransomware, but it could happen. It’s just trying to cast the biggest net to get the biggest number of email addresses, and hope that some of them click,” he says. “It’s literally a phishing expedition.”
Google and Microsoft declined to comment for this story. Apple did not return a request to comment. But fortunately, you can take steps to flag calendar spam—and prevent it from automatically popping up in your calendar again.
Google Calendar: From a Web browser, click on the event in Calendar, but be careful not to reply to it, and not to click on any of the links within it. At the top, under the Going section, click “Report spam.” The event, along with all others from that organizer, will be removed from your Calendar.
To prevent more spam from showing up on your Google Calendar in the future, click the Gear icon in the upper-right corner, and go to Settings. Scroll down to Event Settings, and change Automatically Add Invitations to, “No, only show invitations to which I have responded.”
Outlook Calendar: Similar to stopping spam in Google Calendar, open your Outlook Calendar in a Web browser, and click the Gear icon in the upper-right corner. Then click View Full Settings and, from the left pane, Calendar. From the right pane, click Calendar in Email.
Under “Events from email,” uncheck “Automatically add events to my calendar from email,” then click the Save button. This will prevent useful events like flights or concerts from being automatically added to your calendar, but it will also stop spam from showing up. At the time of writing, Microsoft did not appear to have a spam-reporting option in Outlook Calendar.
iCloud Calendar: Apple added a spam event-reporting feature to Calendar invitations at the end of 2016, following a bad spate of Calendar spam. To use it, open Calendar in iCloud.com, click on the spammy event, and click Report Junk. Then click OK to remove the event from all your iCloud-synced devices.