THE SCAM

A meeting or a "subscription renewal" notice pops up on your Google Calendar that you never agreed to. It sits right next to your real appointments, so your brain treats it as legit — it came from your own calendar, after all.

It didn't. With the default calendar setting, Google auto-adds invitations from anyone, and the fake event can survive even when your email security caught the matching email. Some of these carry alarming billing claims for several hundred dollars with a phone number to "cancel or dispute"; others carry a "credit note" link that is really a download for remote-access software.

THE RED FLAG

You never accepted the invite — it invited itself. An event from a total stranger sitting next to your dentist appointment is the trick: it borrows trust from the real things around it.

Security firm Sublime Security says calendar-based attacks jumped 1,216% in August over July. Malwarebytes documented fakes impersonating its own billing department with made-up renewal charges, and one analyzed case led victims to an installer for ScreenConnect — a legitimate remote-management tool the attackers configured for themselves. The calendar entry charges you nothing; the panic it creates is the product.

THE RULE

Never click a link, call a number, or open a download from an unexpected calendar invite. Check any billing claim inside your real account or by typing the company's real address yourself — never through the invite.

On a computer, open Google Calendar, go to Settings, then Event settings, then "Add invitations to my calendar" — switch it to "Only if the sender is known" or "When I respond to the invitation in email." And for a suspicious event, open it, hit More actions, and choose Report as spam.

Read it on the site: https://erawaeb.com/digest/daily/029-the-calendar-invite-you-never-accepted/

(Source: Consumer Affairs consumer alert, October 12, 2026 (Sublime Security, Malwarebytes))

— One scam. One red flag. One rule. Every day.