Google Calendar invite phishing bypasses spam filters to steal credentials

What is this scam?

Google's June 2026 fraud advisory highlights a significant surge in Calendar invite phishing affecting UK users, where attackers send fake Google Calendar invitations containing links to phishing pages. Because the invites are delivered through Google's own Calendar infrastructure, they bypass most spam and phishing filters and appear as genuine event notifications. Victims who click the embedded link are taken to convincing fake sign-in pages designed to steal Google account credentials, payment card details, or personal information.

Example scam message

Red flags to look out for

• The message creates urgency — threatening a fine, missed delivery, or account closure.
• Links lead to unofficial domains that don't match the real company's website.
• You weren't expecting this message and can't verify the event it references.
• It asks you to confirm payment details or personal information via a link.
• The sender's number or email address doesn't match the company's official contact.

What to do if you receive this

1. Do not call any numbers or click any links in the message.
2. Log in to your account directly via the official website or app to check for any real alerts.
3. Forward the message to 7726 or email report@phishing.gov.uk.
4. Report it to Action Fraud at actionfraud.police.uk.