Malware is infesting Google Calendar. Here's how to stay safe

Summary

Beware of fake Google Calendar email invites with embedded links — they could be scams.
Double-check the sender of an unexpected calendar invitation to verify its authenticity.
Also use “Show Original” in the email to check the sender field for “calendar-notification@google.com” to see if it’s a real calendar invite.

Google Calendar is one of the most popular apps in the world for organizing events and staying on top of meetings. While Google is continously working on the safety and security of its beloved calendar app, bad actors are always looking to take advantage of the service to steal personal information or inject malware onto your device.

One of the most prominent ways hackers and scammers try to dupe people using Google Calendar is by using fake calendar invites (via Wired). These phony email invites usually look legitimate and appear to be just simple calendar invites. However, clicking a link in them could take you to a website that tricks you into providing personal information or downloads malware. Luckily, there are easy ways to check if you’ve got a real Google Calendar Invite.

Google Calendar

OS: iOS, Android, macOS, Windows, Linux
App: Free

Gulf of America/Mexico on iPhone screen with maps background

Google doesn’t want your opinions on the Gulf of America

Google is blocking reviews of the Gulf of America after its faced criticism for changing the name from the Gulf of Mexico.

How to verify a Calendar Invite on Gmail

Always double-check who the email is from and verify it’s an official calendar invite

One of the best ways to protect yourself on Google Calendar is to be wary of invitation emails with links embedded in them and to always double-check the sender. A good rule of thumb is to only follow invite links you are expecting, such as a weekly meeting or an invitation to an event you know is coming up.

If you receive an email invitation for something unexpected, be cautious and consider who sent it. If the email looks like it came from within your organization or someone you know, you can always check the full email address of the sender and verify if it’s from Google Calendar. Here’s how.

1. In the Gmail invitation email, click the three dots in the top right corner.

2. Click Show Original.

3. Check the From: section to verify who the email came from.

4. Also check the sender field, it should read “calendar-notification@google.com” if it’s a real Google Calendar Invite.

To find the sender field on Google Calendar easily, try using Ctrl+F or Cmnd+F and typing in
“sender:”
when viewing the original email.

If you get a Google Calendar invite that is clearly a scam, it is always best to report it as phishing and block the sender. To find out more about keeping your Google account secure, you can check out Google’s official help center.

As an extra layer of security, I recommend having two-factor-authentication enabled on your Google account as well. It helps further protect your account in the event it becomes compromised. Google is always working on Calendar’s security, so hopefully most scam emails that get sent your way end up in your junk mail, but in the event one slips through the cracks, the steps outlined above are an easy way to double-check its authenticity and keep you and your personal information safe.