You can prevent spam and "calendar phishing" invitations from automatically appearing on your Google Calendar by adjusting your event settings.

Google's default setting, "From everyone," has worked well for years, but recently, malicious actors have started to use this to send spam invitations that automatically appear on your calendar. These fake events often contain malicious URLs designed to redirect you to phishing pages or infect your device.

To prevent this, you can change your setting to allow only events from "known senders" to be added automatically.

Change your calendar to add invites "Only if the sender is known"

This setting provides a critical security measure by changing how your calendar processes incoming invitations.

• Known Senders: Invitations from senders who are in your Google Contacts, part of your organization's domain (e.g., @brown.edu), or with whom you have previously interacted will continue to be added to your calendar automatically.

• Unknown Senders: Invitations from external senders you have not interacted with before will not be automatically added to your calendar. Instead, you will receive the invitation as an email, and the event will only appear on your calendar after you affirmatively approve it.

How to Update Your Calendar Settings

Google keeps a full set of detailed instructions at in their Support Center, which we have summarized here.

Follow these steps to enable the "Only if the sender is known" setting:

1. Open Google Calendar.

2. In the top-right corner, click the Settings gear icon and select "Settings".
   
   

3. On the left-hand menu, under "General," click "Event settings".
   
   

4. Find the dropdown menu labeled "Add invitations to my calendar".

5. Change the selection to "Only if the sender is known".
   
   

Changes will apply to future invitations and do not affect events already on your calendar.

For Users with Calendar Schedulers or Delegates

When you enable the "Only if the sender is known" setting, invitations from unknown senders are not added to your calendar and are sent to your email instead. This can prevent a person who manages your calendar (a scheduler or delegate) from seeing and processing those invitations.

You can, however, allow a delegate to see these pending invitations even when they are hidden from your own view:

1. In Google Calendar, go to Settings > Settings.

2. On the left, under "General," click "Event settings".

3. Below the "Add invitations to my calendar" dropdown, find the checkbox labeled "Let others see all invitations if they have permission to view or edit my events".

4. Ensure this box is checked. This will allow those who manage your calendar to see all incoming invitations, including those from unknown senders, even when they are not yet visible on your main calendar.

Note: This option only appears after you have selected "Only if the sender is known" or "When I respond to the invitation in email".

How to Report Spam Events on Your Calendar

If a suspicious or unauthorized event already appears on your calendar, do not click any links within it. You should report it as spam immediately.

1. Open the suspicious event in Google Calendar.

2. At the top right of the event details pop-up, click the More actions menu (three vertical dots).

3. Select "Report as spam".

4. Confirm the action. The event will be removed, and the sender will be flagged.