Scammers are targeting your calendar—here’s how to stop them

Your Google calendar is a sacred, semi-private place full of scheduled meetings you’d rather not attend and appointments you’d probably like to skip. So when spam suddenly appears there—advertising something like “Your iPhone XS is ready for PickUp,” followed by a link—it’s jarring and invasive.

This particular kind of spam is garnering attention lately. “I have a feeling that it is on the upswing,” says Shuman Ghosemajumder, the CTO of cybersecurity company Shape Security who also worked as the “click fraud czar” at Google. Fortunately, there are steps you can take to both stop it as well as report it when you see it. It’s also worth remembering that while the location of the spam feels new, the behavior isn’t. Bad actors have a long history of exploiting any avenue they can, from sending suspicious messages to your email address, to spammy notes sent via iMessage, to robocalls.

Philosophically speaking, the problem lies in the fact that mediums like our phones, email inboxes, and calendars are designed, by their nature, to be able to receive things—phone calls, messages, and invitations. And of course, people abuse that access.

In this case, there’s a very simple way to tweak the settings in your Google calendar to stop this spam if it has already cropped up in your account, or proactively prevent that from happening. Look for the gear icon towards the top right of your Google calendar in a browser, then use it to click on Settings. From there, in the column to the left, click on Event settings, then eyeball the box titled “Automatically add invitations.” Make sure you choose: “No, only show invitations to which I have responded.”

Then, in the same column to the left, look for a row called “Events from Gmail.” You’ll want the box next to the words “Automatically add events from Gmail to my calendar” to be unchecked. When that is checked, Google adds events such as the upcoming flight it sees in your email to your calendar automatically; unchecking that box locks your calendar down even further.

But like many security issues, there are tradeoffs to your choices—some people may like that their dinner reservations automatically populate their calendars—so make whatever decision here you feel is best for you.

Google published a short video, below, earlier this month explaining how to report any spam in your calendar you see—taking that kind of action will simultaneously remove the offending event while also likely helping Google prevent more spam like it.

Finally, while you’re thinking about security, privacy, and Google, it can’t hurt to take advantage of relatively new features that Google offers that give you the option to have some of your data automatically deleted from their systems. To explore those, go to your Google Account on a desktop, click on Data & personalization, then Web & App Activity, then Manage Activity, then make a choice by clicking on “Choose how long to keep.” A similar option exists in the Google Maps app: In that app on your phone, click on the three horizontal lines at upper left, then Settings, then Personal Content, then “Automatically delete Location History” to make a choice. If you’d like to have that type of data deleted every three months, you can do so there.