The phishing email got blocked. The meeting still landed in the calendar

Here is the gap the scammers found. When an invitation arrives by email, most calendar systems add the event automatically before anyone decides whether the sender is trustworthy. So if the mail server later decides the message was phishing and quarantines it, the email vanishes and the meeting stays. You open your calendar on Monday and there it is, looking like any other appointment someone booked with you.

Sublime Security, which builds email detection tooling, has been tracking the climb. A 282 percent rise from May to June this year, 338 percent from June to July, then 1,216 percent in August over July. Microsoft separately logged a 277 percent increase in malicious calendar invitations in June. Back in late 2025, more than a fifth of all callback phishing already arrived this way, and callback is usually the point: the invite carries no link worth clicking, just a phone number and a story about a subscription charge or an account problem. You call, a person answers, and the rest happens over the phone where no filter can see it.

Two settings fix most of this. In Google Calendar, under Event settings, change "Add invitations to my calendar" to only when the sender is known. Outlook has an equivalent option that stops invites being processed automatically. Beyond that, the old rule holds with more force than ever: a phone number that arrives with a problem attached is never the number to ring. Look the company up yourself.

If one of these ever does talk you into installing something, Tendvane's Safety check flags unwanted programs and remote-access tools that have appeared on your PC, which is usually the first visible trace of a call that went wrong.