THE SCAM
The calendar invite you never accepted.
A meeting or a "subscription renewal" notice pops up on your Google Calendar that you never agreed to. It sits right next to your real appointments, so your brain treats it as legit — it came from your own calendar, after all.
It didn't. With the default calendar setting, Google auto-adds invitations from anyone, and the fake event can survive even when your email security caught the matching email. Some of these carry alarming billing claims for several hundred dollars with a phone number to "cancel or dispute"; others carry a "credit note" link that is really a download for remote-access software.
THE RED FLAG
You never accepted the invite — it invited itself. An event from a total stranger sitting next to your dentist appointment is the trick: it borrows trust from the real things around it.
Security firm Sublime Security says calendar-based attacks jumped 1,216% in August over July. Malwarebytes documented fakes impersonating its own billing department with made-up renewal charges, and one analyzed case led victims to an installer for ScreenConnect — a legitimate remote-management tool the attackers configured for themselves. The calendar entry charges you nothing; the panic it creates is the product.
THE RULE
Never click a link, call a number, or open a download from an unexpected calendar invite. Check any billing claim inside your real account or by typing the company's real address yourself — never through the invite.
On a computer, open Google Calendar, go to Settings, then Event settings, then "Add invitations to my calendar" — switch it to "Only if the sender is known" or "When I respond to the invitation in email." And for a suspicious event, open it, hit More actions, and choose Report as spam.
(Source: Consumer Affairs consumer alert, October 12, 2026 (Sublime Security, Malwarebytes))
SIGN-OFF
That's today's red flag. One scam, one red flag, one rule — pass it to someone who clicks first and asks questions later.
Got a scam text or a sketchy email? Send it via the contact page — the best ones make future red flags.