Gmail Calendar Spam 2026: Block Scam Invite Auto-Add

You open Google Calendar to map out your afternoon, and squeezed between two real meetings is an entry you never put there: a "Final Payment Reminder — $412.99 pending," a "Package could not be delivered, confirm here," or a "You've been selected for a crypto airdrop." Nobody asked your permission. You didn't open an email or click accept. Yet there it sits on your agenda, decorated with a bright link, a countdown, and just enough manufactured panic to make you tap before you think. This is Gmail calendar spam, and by 2026 it has become one of the scammers' favorite routes for putting a phishing link in front of someone who would never bother reading a junk email.

None of this is accidental — it's the point. For years, Google Calendar was designed to be helpful: an invite that hit your inbox was automatically added as an event so a real meeting never slipped past you. Attackers took that helpfulness and turned it into a shipping channel. The good news is that Gmail calendar spam sits in a rare category of email threat that a single setting can almost completely shut off — no antivirus, no new account, no technical background needed. Below, you'll find exactly why these invites appear, the one toggle that stops around 95% of them, how to clear out events that have already burrowed into your calendar, and the one button you must never press.

What Gmail Calendar Spam Actually Is

Every Google account comes bundled with a Google Calendar, and the pair shares one contact list and one set of trust assumptions. Historically, when a stranger fired a calendar invitation at your Gmail address, Google did something well-meaning with it: the event landed on your calendar so you'd catch it even if the email went unread. Gmail calendar spam is nothing more than that behavior turned against you — an outsider points an invite at your address, and a "meeting" whose title and description they wrote from top to bottom shows up on your schedule.

These aren't emails sitting in a spam folder, waiting to be clicked. They are appointments that appear inside the very tool you use to organize your day, reminders included — capable of buzzing your phone at whatever hour the scammer decided. And because the event looks like every other block on your calendar, your guard sits lower than it would for a message from an unknown sender. Lowering that guard is the entire point of Gmail calendar spam: it borrows the trust you place in your own calendar to walk a link past the suspicion you'd normally aim at a cold email.

The copy sticks to a predictable script. Nearly every invite orbits money or shipping — a subscription "renewing," an invoice "past due," a parcel "on hold," a reward "about to expire." All of them include a link or a phone number and a deadline. The payoff the scammer wants is never the calendar entry; it's the tap that follows. Understanding that the event is just a billboard for a phishing link is the first step toward seeing Gmail calendar spam as what it really is: a phishing attempt wearing a meeting costume.

Why It's Pouring In So Heavily in 2026

If calendar spam feels like it appeared out of nowhere, there's a concrete reason. On accounts created before mid-2024, the default invitation setting was "From everyone," which meant any invite from any address added itself to your calendar automatically. Google flipped the default to "Only if the sender is known" for newer personal accounts — but millions of older, well-established accounts were never migrated. If your account has some age on it, odds are you're still on the permissive default, which is exactly why long-lived inboxes get hit the hardest.

On the other side of the equation, supply exploded. AI tools have made it trivial to generate thousands of convincing invite variants and blast them at scraped address lists, and calendar invites slide past plenty of spam filters that are tuned to scrutinize the email body. Researchers tracked a sharp rise from late 2025 into 2026, including one campaign in which scammers impersonated a well-known security vendor and sent out fake multi-year "renewal receipts" padded with invented membership IDs and transaction numbers. An outdated default plus cheap automation is the pairing that turned Gmail calendar spam from an occasional annoyance into an everyday one.

There's a targeting logic behind it worth understanding. Addresses that have been active for years, that surface in data breaches, or that get used to sign up for countless services are more valuable to spammers because they're proven real and proven watched. It's the same reason aged, well-tended inboxes carry weight for legitimate outreach too — something we explore in our guide to how Gmail account age affects deliverability. The difference is that scammers want your attention for the wrong reasons, and your calendar is the simplest place to grab it.

Why Calendar Phishing Is More Dangerous Than It Looks

Dismissing a random calendar event as harmless clutter is easy — and wrong. Gmail calendar spam is a phishing vector, and the same 2026 attack techniques that make email phishing dangerous fire the moment you tap the link inside an event.

• Credential theft. The link loads a page dressed up as a Google, bank, or retailer login. You type your password into a fake form and hand it straight to the attacker.
• Session cookie theft. Craftier pages run as a live proxy that captures the session token issued after you log in — going around two-factor completely. We dig into that mechanism in detail in our breakdown of Gmail session hijacking and cookie theft.
• Callback scams. Some invites list a phone number instead of a link, putting you through to a fake "support" agent who talks you into installing remote-access software or reading out a verification code.
• Payment fraud. Bogus invoices and renewal notices push you to "cancel" a charge that never existed, which really means typing card details into a lookalike checkout.

The calendar wrapper works so well because of trust transfer. You already trust your calendar, so an item living inside it inherits a credibility a bare email could never earn. That's the same psychology powering the wider wave of inbox threats Google flagged this year, which we cover in Google's 2026 scam advisory. Treating Gmail calendar spam as a genuine security issue rather than a cosmetic one is what divides the people who quietly fix it from the people who eventually tap the wrong link.

The One Setting That Stops Most Calendar Spam

Here's the single change that does most of the work. Buried in Google Calendar's settings is an option called "Add invitations to my calendar," and switching it from "From everyone" to "Only if the sender is known" blocks roughly 95% of Gmail calendar spam before it can ever reach your schedule. Invites from strangers stop adding themselves; you'll still see legitimate ones surfaced in Gmail so a real new contact never slips past you, but random spam never touches your calendar.

In a desktop browser, the steps run like this:

• Open Google Calendar on the web, click the gear icon at the top right, and choose Settings.
• In the left-hand menu, under General, click Event settings.
• Find Add invitations to my calendar and change it to Only if the sender is known.
• The change saves itself — there's no confirmation button to click.

"Known sender" isn't a guessing game. Google treats a sender as known if they satisfy any of the criteria in the table below, which is why the setting almost never turns away people you actually deal with:

For the vast majority of people, "Only if the sender is known" is the sweet spot: it kills Gmail calendar spam without making you babysit every real invitation. If invites from brand-new contacts almost never come your way, "When I respond to the invitation email" is stricter still and completely safe. Whichever you choose, the permissive "From everyone" is the setting to leave behind for good.

Killing Calendar Spam on Android and iPhone

The web setting syncs to every device signed in to the same Google account, so changing it once on desktop usually sorts out your phone as well. Still, you can adjust it directly in the mobile app, and it's worth confirming the value there, because a stray "From everyone" left on one device can keep Gmail calendar spam flowing in.

On the Google Calendar app for Android:

• Tap the menu (three lines) at the top left, then scroll down to Settings.
• Tap General.
• Under Adding invitations, tap Add invitations to my calendar and pick Only if the sender is known.

On iPhone: if you use the Google Calendar app, the path is the same as Android. If instead your Google account is connected through Apple's built-in Calendar app, the invitation-handling setting lives in Google's web settings rather than in iOS — so make the change on the web and let it sync down. Apple's own Calendar does include a separate "Show invitee declines" option and its own spam-reporting flow, but the root fix for Google invites is always the Google-side "known sender" toggle.

One thing to watch: if you keep several inboxes on a single phone — a common arrangement for anyone running multiple accounts for work, selling, or marketing — you have to set the toggle for each Google account separately. Miss one and that account keeps auto-adding spam. If juggling many inboxes is part of your routine, our overview of managing aged Gmail accounts explains how to keep each one configured and clean without losing track.

Removing Spam Events Already on Your Calendar

Changing the setting halts new spam, but it won't erase events already parked on your schedule. Those you'll have to clear yourself — carefully, because the method matters. The safe way to delete a piece of Gmail calendar spam is to open it and use Google's report-and-remove flow instead of a plain "Delete," and to avoid touching anything inside the event.

• Open the spam event on the web or in the app.
• Find the Report as spam option (on desktop it appears when you open the event or right-click it; on mobile it's in the event's overflow menu).
• Choose Report, and when asked, confirm that you also want to remove the event and report the sender.
• Do not click any link, dial any number, or open any attachment inside the event first.

If an event refuses to vanish or keeps coming back across devices, the culprit is usually a sync issue: the deletion needs a moment to propagate, or a second device is re-adding it because its own setting still reads "From everyone." Correct the setting everywhere first, then report-and-remove. For a stubborn recurring spam event, delete the entire series rather than a single instance. Clearing the existing junk and flipping the toggle is the one-two combination that ends Gmail calendar spam for good.

The Decline Button Mistake That Backfires

This is the most important paragraph in the whole guide, because the instinctive move is precisely the wrong one. When a spam invite shows up, most people's first reflex is to hit Decline, RSVP "No," or unsubscribe. Resist it. Declining sends a response back to the organizer — the scammer — and that response confirms two things they badly want to know: your address is live, and you actually read invitations from unknown senders. In the economics of Gmail calendar spam, a confirmed, engaged address is worth far more than an unknown one, so declining doesn't remove you from lists — it moves you to the top of them.

The same logic applies to any "unsubscribe" link stuffed inside a spam event or its description. Those links are frequently just another tracker or phishing hop; clicking one signals engagement and, at worst, drops you onto a credential-harvesting page. The correct response to Gmail calendar spam is silent removal: use Google's Report-as-spam flow, which deletes the event without RSVPing, or simply delete it once you've flipped the "known sender" toggle. Act, don't reply. Every interaction that travels back to the sender makes your inbox a bigger target; every silent removal makes it a smaller one.

How to Report Calendar Spam to Google

Reporting does more than clean up your own calendar — it feeds Google's detection systems so the same campaign gets throttled for everyone. When you use the built-in Report as spam control on an event, Google both removes it from your calendar and flags the sender, and it does so without firing an RSVP back to the attacker, which is why it always beats a manual delete.

A few habits make your reports count for more:

• Report from the event itself, not by deleting the notification email, so Google links the report to the specific invite.
• Report recurring spam as the entire series when prompted, so every future instance is covered.
• Don't edit the event first — changing anything can break the reporting connection between the event and the flagged sender.
• Pair reporting with the setting change. Reporting deals with what's already there; the "known sender" toggle heads off the next wave.

If you're drowning in invites alongside broader account noise — newsletters, promotions, and subscriptions you never signed up for — it's often the same root problem: your address is on too many lists. Our guide to managing Gmail subscriptions and bulk-unsubscribing pairs well with locking down Gmail calendar spam, since both come down to controlling who's allowed to reach you.

Gmail-Side Settings That Block Auto-Created Events

There's a second, less obvious source of unwanted calendar entries: Gmail itself. Google's "smart features" can build calendar events straight out of your emails — flights, hotel bookings, package deliveries, restaurant reservations. That's convenient for real messages, but it also means a cleverly formatted phishing email can slide an entry onto your calendar with no invitation at all. To close that door alongside the main Gmail calendar spam fix, adjust two things.

• In Google Calendar settings, under "Events from Gmail," turn off Show events automatically created by Gmail if you'd prefer not to have auto-parsed entries.
• In Gmail settings, review the Smart features and personalization controls, which govern how much of your mail content Gmail is allowed to read to generate suggestions and events.

These smart features also feed the broader push to weave AI throughout the inbox, and plenty of users prefer to dial that back for privacy as much as for spam control. If that describes you, our walkthrough on turning off Gmail's AI features covers the full set of toggles. Between the "known sender" invitation setting and the Gmail-side auto-event controls, you've closed both the front door and the side door that Gmail calendar spam and auto-created clutter use to get in.

Calendar Spam for Business and Multi-Account Users

If you operate more than one Google account — for a business, a store, cold outreach, or client work — calendar spam scales right along with you, and so does the risk. Each inbox is its own calendar with its own invitation setting, so one overlooked toggle leaves a single account bleeding spam while the rest stay clean. Worse still, a phishing link tapped inside a business calendar can compromise an account tied to ad spend, payment methods, or customer data. For anyone running many inboxes, treating the "known sender" setting as part of standard account setup — not an afterthought — is the difference between a tidy operation and a support headache.

Google Workspace admins get an extra lever: organization-wide policies can enforce invitation handling and flag external calendar invites before users ever see them, which is the enterprise version of the same fix. For individuals and small teams without a Workspace admin console, the practical approach is a checklist applied to every account: set invitations to "known sender," switch off auto-created Gmail events if you don't want them, and never decline spam. Consistency across accounts is what keeps Gmail calendar spam from finding the one inbox you forgot. If you're setting up or maintaining a fleet of well-configured inboxes, our aged Gmail account options are built with exactly this kind of baseline hygiene in mind.

Building a Spam-Resistant Google Account

Locking down calendar invites is one piece of a larger habit. The accounts that stay quiet and secure are the ones where a handful of settings get configured once and then left alone. Alongside the "known sender" toggle, a spam-resistant account layers on the fundamentals that blunt every downstream attack.

• Turn on strong two-factor — ideally a passkey or security key, not SMS — so a stolen password on its own can't open the account.
• Audit connected apps and filters from time to time, because attackers who do get in often hide forwarding rules and third-party access.
• Keep your recovery email and phone current so you can reclaim the account fast if something slips through.
• Treat urgency as a red flag. Every piece of Gmail calendar spam leans on a deadline; real companies rarely stamp a countdown on your calendar.

Our full Gmail account security checklist walks through each of these in turn. The thread running through all of it is simple: convenience defaults are what attackers exploit, and a few minutes spent tightening them — starting with the invitation setting that ends Gmail calendar spam — buys you an inbox that stops working for the scammers and starts working only for you.

Frequently Asked Questions

Why do I keep getting Gmail calendar spam when I never accepted the invites?

It all traces back to the "Add invitations to my calendar" setting. If it's set to "From everyone" — the old default on accounts created before mid-2024 — Google auto-adds any invitation to your calendar without asking. You never accept anything; the event just appears. Switching the setting to "Only if the sender is known" stops that automatic behavior and blocks roughly 95% of the spam.

Should I decline or RSVP "No" to a spam calendar invite?

No — never decline or RSVP to spam. Declining sends a reply back to the scammer confirming that your address is real and that you read invitations from strangers, which makes you a higher-value target and drives future spam up. Instead, use Google's "Report as spam" option, which removes the event and flags the sender without sending any response back to them.

Will "Only if the sender is known" block real invitations from new people?

Rarely, and never silently. Google still shows invitations from unknown senders inside Gmail, so you can spot and accept a legitimate one from a brand-new contact — it simply won't auto-add to your calendar until you do. Anyone in your contacts, anyone you've emailed, colleagues on your Workspace domain, and calendars you subscribe to all count as "known," so the people you genuinely work with come through as usual.

How do I get rid of spam events that are already on my calendar?

Open the event and use "Report as spam," then confirm that you want to remove it and report the sender. Don't click any links, dial any numbers, or edit the event first. If a spam event keeps coming back after you delete it, check that the "known sender" setting is applied on every device signed in to the account, since a leftover "From everyone" on one device can re-add it.

Is Gmail calendar spam actually dangerous or just annoying?

It's genuinely dangerous. The event is only a wrapper; the payload is a phishing link or phone number built to steal your password, hijack your session cookie past two-factor, or push a fake invoice. Because the item lives inside your trusted calendar, people tap links they'd never click in a cold email. Treat every unexpected calendar invite as a phishing attempt until proven otherwise.

Calendar spam is a solvable problem — one setting, a quick cleanup, and the discipline never to hit Decline. If you want more plain-English Gmail security and troubleshooting guides, plus early warnings on new scam campaigns as they surface, join our community on Telegram at t.me/oldgmb. We break down each new threat the moment it starts trending, so you can lock your account down before it ever reaches your calendar.