Fake 'You have a meeting' calendar invites deliver phishing links directly to UK users' calendars

What is this scam?

A calendar phishing wave flagged by The Guardian in October 2026 sends fraudulent Google Calendar and Outlook meeting invitations to UK users, bypassing email spam filters by exploiting the fact that calendar apps automatically display invite notifications. The invitations appear to come from legitimate addresses and contain a link described as a meeting agenda, document, or conference dial-in — links lead to credential harvesting sites or malware downloads. Because the notification appears in the calendar app rather than arriving as a conventional email, victims are less alert to the risk. Neither Google nor Microsoft send meeting invitations from external accounts without prior contact.

Example scam message

Red flags to look out for

• The message creates urgency — threatening a fine, missed delivery, or account closure.
• Links lead to unofficial domains that don't match the real company's website.
• You weren't expecting this message and can't verify the event it references.
• It asks you to confirm payment details or personal information via a link.
• The sender's number or email address doesn't match the company's official contact.

What to do if you receive this

1. Do not call any numbers or click any links in the message.
2. Log in to your account directly via the official website or app to check for any real alerts.
3. Forward the message to 7726 or email report@phishing.gov.uk.
4. Report it to Action Fraud at actionfraud.police.uk.