🛑 FRAUD ALERT: A calendar notice is not proof you owe money

Deleting the email may leave the invitation behind

In research published November 3, 2025, Sublime Security described malicious invitations that could remain on a calendar after the related email was quarantined or deleted. Whether an invitation appears automatically depends on the calendar settings.

One documented example carried a separate callback number in the invitation. Moving the request into a familiar calendar interface gave the same deceptive message another place to be seen. An event appearing there is not, by itself, proof that someone logged into your account.

Sources: Sublime Security · Google Calendar Help

Watch the requested action, not just the familiar layout

Sublime's September 17, 2026 research described a financial-themed calendar invitation that led to a download of a remote-access tool configured for malicious use. This was an observed attack example, not evidence that every unexpected invitation installs software.

Pause when an unsolicited event pushes you to call about a charge, sign in through an attached link, download software or act immediately. Verify the account or appointment outside the invitation. The FTC's longstanding phishing guidance provides the protective rule below.

Sources: Sublime Security · Federal Trade Commission

Reduce automatic additions without trusting the sender

On a computer, Google Calendar settings let you control which invitations are added. Under Event settings, open Add invitations to my calendar and consider When I respond to the invitation in email. You still need to evaluate the email before responding.

Google says changes apply only to new invitations. Work or school administrators may restrict the available options. Changing this setting is prevention for future invites, not a cleanup of existing entries or proof that a familiar sender is safe.

Sources: Google Calendar Help

Remove the unwanted event through the calendar app

Use the calendar service's own removal or reporting controls, not an unsubscribe link inside the suspicious event. For iPhones running iOS 26 or later, Apple says an event from an unknown contact can be reported using Report Junk, then Delete and Report Junk.

If the problem is an unwanted subscribed calendar, Apple also provides an unsubscribe option in the Calendars list. Identify the unwanted subscription carefully rather than deleting a personal or shared calendar you use.

Sources: Apple Support

If you called, signed in, downloaded something or paid

Stop following the sender's instructions. If you disclosed a password, change it through the real service and replace it wherever you reused it. If you paid, contact the bank, card issuer or payment service promptly and ask whether the payment can be reversed. Recovery is not guaranteed.

If you granted remote access, the FTC advises updating security software, running a scan and removing anything it identifies as a problem. On a work device, involve your technology support team. Preserve the invitation and related messages for your report; suspected fraud can be reported at ReportFraud.ftc.gov.

Look up or report a suspicious callback number on PhoneYa for community context. A lookup cannot authenticate the event, the caller or the company. The decisive check is still the account or contact route you reached independently.

Sources: Federal Trade Commission · Federal Trade Commission