Ask Advisory is a weekly series where we take a real question our team hears from clients, break down the fast fix, and show the change we make so it doesn’t happen again.
The Ask
“How to stop phishing calendar invites from appearing automatically in Google or M365.”
You open your calendar to plan the week and there’s an event you don’t recognize, sitting tomorrow afternoon with an alert already set.
Title: “URGENT: Q3 Executive Compensation Review and Performance Grant.”
Body: “Your annual performance evaluation document has been finalized. Review and sign via DocuSign,” followed by a link that isn’t actually DocuSign.
An unfamiliar meeting appearing on your calendar without an invite is almost always a phishing attempt sent as a calendar file, not a real synced event. Never respond to it, even to decline. Reporting it directly through the calendar app is the safe move.
You never got an email about it. You never clicked Accept. You don’t know the organizer. And yet it’s sitting on your calendar, looking completely official.
The Fix
If you’re the one who spotted it, or a helpdesk tech triaging a report, the order of operations matters here.
Don’t click anything, including Decline. This is the part people usually get backward. Clicking Decline, Maybe, or Accept, or any link in the invite, sends a response back to the sender’s server. That confirms your email address is real, active, and worth targeting again.
Report it through the calendar app itself, not your inbox. In Google Calendar, open the event, click the three-dot options menu, and select Report spam or Report as phishing. That removes it and feeds the workspace’s spam filters. In Outlook, right-click the invite and choose Report, then Report Phishing, or use your company’s phishing button if you have one, like KnowBe4 PhishER.
Tighten your own auto-add settings. In Google Calendar, go to Settings, then Event settings, then Add invitations to my calendar, and change it from “From everyone” to “Only if the sender is known.” In Outlook on the web, go to Settings, then Calendar, then Automatic processing, and uncheck automatic processing of invites from external senders.
That clears the one invite. It doesn’t explain why it landed on the calendar automatically in the first place, before anyone had a chance to look at it.
The Fix That Sticks
Telling people to be careful is only half the job, and honestly the weaker half. Calendar phishing works specifically because most people are trained to be suspicious of email, but nobody’s trained to be suspicious of their own calendar. It feels internal by default. The real fix happens upstream, at the mail gateway, before the invite ever reaches an inbox.
Inspect calendar attachments the same way you inspect links. Most secure email gateways scan message bodies for malicious URLs but wave .ics calendar files through as harmless metadata. Configuring advanced protection, whether that’s Microsoft Defender for Office 365, Google’s advanced phishing protection, or a layer like Abnormal or Mimecast, to unpack .ics files and run any embedded URLs through the same reputation check as a regular link closes that gap.
Set the auto-add policy at the organization level, not per person. Individual settings get missed constantly, and a new hire has no idea this is something they should even check. Google Workspace admins can set external invitation handling to “only known senders” tenant-wide. In Microsoft 365, the same thing is done through mailbox policy, suppressing automatic processing for external invites by default.
Enforce strict domain authentication. Attackers spoof the organizer field to look like a CEO or an HR director. A strict DMARC policy, combined with DKIM alignment checks, means a spoofed message claiming to come from inside the company actually gets rejected or quarantined instead of landing in a calendar.
Have a fast, automated cleanup path. When someone does report one of these, tools like Microsoft 365 Explorer or Google’s security investigation tool can search by the invite’s organizer domain or unique ID and pull it from every affected mailbox across the company in under a minute, instead of hoping everyone reports it individually.
Why It Matters
This one matters more than it looks like it should, because it targets a blind spot most security training never covers. People are taught to distrust suspicious emails. Almost nobody is taught to distrust their own calendar, which makes it a highly effective way to reach finance and executive teams specifically.
It’s also one of the higher-converting phishing formats out there. A fake DocuSign or HR portal link inside a calendar invite gets clicked at a much higher rate than the same link in a cold email, so stopping it at the gateway is stopping credential theft before it has a chance to start.
It quietly protects your security team’s time too. Every one of these that lands generates a “did I get hacked” ticket, which pulls SecOps attention away from alerts that actually need it.
And like the others, it’s not just good hygiene, it’s what SOC 2 Type II, ISO 27001, and most cyber insurance underwriters are explicitly looking for: proactive social engineering defense and automated threat remediation, not a policy document that says employees should “stay vigilant.”
If your team’s fielding “is this calendar invite real” questions on a regular basis, that’s usually a sign your mail gateway is treating .ics files as trusted by default, and that’s exactly the kind of gap an environment audit catches before anyone clicks.
If that’s an audit you’d want us to run, let’s talk.
