Fake Google Calendar invite that steals your login
Fake calendar invites can steal a live Google login even after you approve a real two-step prompt. Do not click links inside an unexpected invite. Open Calendar yourself instead.
How it works
You receive a calendar invite, sometimes from a name you do not know, with a 'view document' or similar link. The link is made to look like Google. If you follow it and approve a real two-step or sign-in prompt, attackers can still capture the session and get into the account. This is a current phishing trick used against regular users as well as offices. The safest habit is to ignore unexpected invites and check your calendar only by opening the Calendar app or site yourself.
Red flags
- A meeting appears from someone you do not know.
- The invite includes a link to view a document or open a file.
- You did not expect the meeting and were not already talking with the sender.
- The invite tries to get you to approve a sign-in or two-step prompt.
What to do
- Do not click links in unexpected calendar invites. Delete the invite and move on.
- If you need to check a real meeting, open Google Calendar yourself and look there.
- If you already clicked and signed in, change your Google password, review recent devices, and turn off any unknown access.
- Report the message at reportfraud.ftc.gov and, if an account was taken, also at ic3.gov.
Where to report it
- reportfraud.ftc.gov — the FTC's report form.
- ic3.gov — the FBI's Internet Crime Complaint Center.