A meeting on your calendar isn’t proof that someone belongs in your workday.
Scammers are using calendar invitations to make phishing attempts look like ordinary business activity. An invite might promise a project brief, link to a fake Microsoft or Google sign-in page, or ask you to download something before a call. Security researchers have documented fake calendar invitations designed to steal login credentials.
Depending on your calendar settings, an invitation can appear on your schedule without you accepting it first. That familiar meeting reminder can make an unexpected request feel more legitimate than it really is.
Before following a link, ask whether you were expecting the meeting and whether the request makes sense. If something feels off, verify it through a separate, trusted channel, not through the contact details inside the invitation. A familiar sender’s name isn’t enough, either. Compromised accounts can send fraudulent invitations to real contacts.
Your IT team can also review how invitations are added to your calendar and whether phishing-resistant sign-in options, such as passkeys, are appropriate for your business. These protections help reduce reliance on employees spotting every convincing fake.
Want help reviewing your business’s email and calendar security? Reach out to Bernie Orglmeister at support@skyviewtek.com or call 610-590-5006.