Won a free iPhone? No, it’s Calendar spam

Graham Cluley

Google Calendar spam tries to phish users with free iPhone offers

Won a free iPhone? No, it's Calendar spam

An increasing number of people are reporting that their calendars are being bombarded with spam invitations.

In the example shown below, the invitation is claiming that the recipient has won an Apple iPhone X.

Iphone invite

You Have Won iphoneX from AppleStore

► Apple Store – [LINK]

✅ Free i Phone X s is yours, fill your delivery address, offer available for 8 hours.

✅ Go to – [LINK]

Sorry to break the bad news, but you haven’t really won an iPhone X.

And, of course, you shouldn’t visit the link as who knows what might lurk at the end of it. It could range from anything to a survey scam to a webpage attempting to phish your passwords, or even install malware.

It isn’t new for spammers to spread their campaigns via calendar invitations rather than email, but the technique does seem to have grown in popularity recently.

The truth is that spammers are using the technique through sheer desperation. They want their scam messages to appear in front of as many eyeballs as possible, and as email filters have improved in filtering traditional spam messages alternative methods have had to be deployed.

The bad guys’ hope is someone somewhere might just click on their link.

Fortunately you can prevent unwanted spam invitations from cluttering up your Google calendar without losing much in the way of functionality.

  • Go to your Google calendar, and click on the gear icon near the top right of the screen. Choose Settings from the drop-down menu that appears
  • Cog

  • Select Event settings from the choices in the left-hand menu bar.
  • Event settings

  • Change the Automatically add invitations setting from Yes to No, only show invitations to which I have responded.
  • Display invited replied

Following these steps will prevent Google Calendar from automatically adding any invitations that are emailed to you. From now on you’ll have to respond to event invitations you receive for them to appear in your calendar.

I’m sure for some that will be an inconvenience too far. But if you’re being swamped by spam invitations it may be the best course of action for now.

Graham Cluley Graham Cluley is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows. Now an independent security analyst, he regularly makes media appearances and is an international public speaker on the topic of computer security, hackers, and online privacy. Follow him on Twitter at @gcluley, or drop him an email.

22 Replies to “Won a free iPhone? No, it’s Calendar spam”

  1. Hi Graham … there are other settings that need to be adjusted in addition to the one you mention, particularly "Automatically add events from GMail."

    See here for more details: https://www.howtogeek.com/438305/how-to-stop-spammers-from-attacking-your-google-calendar/

    Note also this does not currently transfer to the Android app – it only covers desktop viewing.

  2. I've made both of those settings changes, but the spam remains on the calendar twice a day for the rest of the current week. Any thoughts on how to make it disappear?

    1. You should be able to just delete the event invitation in your calendar (on Google Calendar you do this by right-clicking and choosing delete). However, I'm not sure if this sends a notification back to the scumbag who sent the event invitation, which would obviously tell them that your email address is "live". :(

  3. Went back and changed invitation settings as you advised, and all the spam disappeared from my desktop – but not from my phone.
    Went to phone's calendar settings and changed settings as advised, but the iPhone giveaway spam was still there.
    So I went ahead and tapped on one of the "events," deleted it and all future repeats of the event, and now my calendar looks like my calendar again.

  4. I removed the events from my desktop, but none of these options seem to be able to remove it from my iphone app. I can't even delete the event!

  5. Thank you for this timely article, Graham. I just noticed this spam showing up in my calendar today but it looks like it started listing two events for each day on the 24th. I made all the changes to my calendar settings listed here and, as noted by David, the events were still showing up on my phone. So, I tried just turning the phone off and then back on. Now the events are GONE from my phone calendar as well.
    Thanks again!

    1. I haven't tested it myself, but AppleInsider has an article which claims to help clear out spam invitations from the iCloud calendar.

      https://appleinsider.com/articles/19/08/26/how-to-stop-icloud-calendar-spam-and-junk-mail

  6. Hi how do you remove these on Android Google Calendar app? I cannot find any information online and the settings seem to be very limited in comparison to the desktop version. Thank you

  7. I click on the link…but nothing happened. The link redirect to me a website [LINK] Is my phone infected 😭…. how i know ? please let me know.

    1. It's hard to say with 100% certainty, but my hunch is that you're ok so long as you didn't enter any personal information and didn't install any software upon visiting the site.

      Often times scams like this will redirect through a number of different sites, and the route might vary depending on a number of factors (where you are in the world, what browser you're using, etc etc). When I visited the link you posted (which I have removed, as I have no wish for other people to go there) it appeared to be an affiliate link for an adult website.

      My hunch is that many people who click on the link might be taken to such websites, rather than have their devices infected. BTW, if your smartphone (you don't say what OS it's running) is up-to-date with the latest security patches then it further reduces the chances of any infection.

      In a nutshell, I probably wouldn't panic if I were you. This campaign was possibly more interested in driving traffic to earn affiliate cash than anything more nefarious.

      1. I am using Xiaomi Redmi Note 3 Pro with Android Marshmallow 6.0.1 , Security: 01 July 2018.

        1. That's obviously not the latest and greatest version of Android that you're running there, but my hunch would be that if you didn't install any software after clicking on the link you're probably ok.

          You could always run an Android anti-virus from a well-regarded security firm to check your device if you're concerned.

  8. Thank you for help with the google cal. But I’m still getting the alerts on my apple cal which I use day to day. Do you know if there are the same settings options that I can change – like you suggested for the google cal?
    Holly

    1. AppleInsider has an article which claims to help clear out spam invitations from their iCloud calendar.

      https://appleinsider.com/articles/19/08/26/how-to-stop-icloud-calendar-spam-and-junk-mail

  9. To remove the events from your Apple iPhone Calendar, go to

    Settings -> Passwords & Accounts

    Then select the Gmail account that was targeted by the spam events.

    Toggle the "Calendars" switch off and tap "Delete from My iPhone" when prompted.

    The spam events should now be gone when you reopen the Calendar app. Assuming you've already changed your Google Calendar settings to remove the spam, go back and toggle the Calendars switch back on in Passwords & Accounts. The calendar app with then re-sync with your sanitized Google Calendar.

  10. Hi there
    i have same issue won Iphone X, but from ASAP Courier Delivery rung me to delvery the item, but missed delivery that day. i ranged next day delivery but he say he wait from the apple reschedule delivery time.delivery. please lets me know and just wondering is that spam too. thank you

  11. Perfect timing of this article – I received my first calendar invite earlier this week and was planning to looking into removal over the weekend. Thanks for serving me the solution on a silver plate!

    Looking forward to listening to the newest episode of Smashin'. Keep up the excellent work!

  12. Just got one today from 8anglepoop@gmail.com
    Glad I came across this article. I bet this is very effective for people who don't even realize the notification is from Calendar.
    The text of the event was "Congratulations You Have Won iPhone XR From YouTube Visit Here Now : – http://youtube.*******.xyz"

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.




Stay informed!

Join thousands of others by signing-up for the free “GCHQ” newsletter, containing the latest news and tips from security expert Graham Cluley.

Name:

Email:

Yes, I would like to subscribe to email updates from Graham Cluley. I know it’s easy to unsubscribe if I ever change my mind.