The Appointment You Never Booked: Calendar Invites Are a Filter's Blind Spot

Most spam advice starts with a simple rule: don’t click the link in the email. But a calendar invite doesn’t need you to click the link in the email. It can arrive as an event, sit in your diary and wait for a reminder to do the persuading. That’s the quiet problem with .ics invites in 2026: the payload is often not the email body at all.

At Spamdex, we spend a lot of time looking at the bits of email that filters treat as plumbing. Calendar data is one of those bits. It is useful, standardised and very easy to spoof. And because it appears inside a calendar app rather than an inbox, it gets a level of trust that a random email never would.

Why a meeting request feels more trustworthy than an email

A calendar event arrives with its own furniture: a time, a location, an organiser, a reminder and a big button that says accept or add. That format borrows credibility. If the event says NHS appointment or council tax reminder, plenty of sensible people will pause and check it, even if they would have binned the same text as an email.

The calendar also sits outside the normal spam experience. You don’t see a junk folder there. You don’t get the same red warning banners in every calendar client. And if auto-add is switched on, the event may not even need your approval. It simply appears, sometimes with a notification, sometimes with a link in the description.

The .ics file is just structured text — that’s the point

An .ics file is an iCalendar object. It is plain text with fields such as summary, start time, location, description and URL. Mail systems often carry it as a text/calendar part, either as an attachment or inline with the message. That is exactly what makes it awkward for filtering.

A lot of email security effort goes into scanning HTML bodies, attachments and links. Calendar data can slip between those checks. The event may contain a URL in the location or description, but the filter may not rewrite or reputation-check it in the same way it would a link in the email body. The invite can also be recurring, so the same event keeps popping back up without a fresh email arriving each time.

Three UK examples doing the rounds

The pattern shows up in very ordinary British admin. A fake NHS appointment invite claims your slot has been moved and points to a rescheduling page. A council tax reminder says your direct debit needs attention and offers a convenient link. A parcel courier invite offers a delivery slot that needs confirming. None of these are new stories, but the calendar format gives them a fresh delivery route.

The common thread is urgency plus a familiar ritual. We are used to rescheduling appointments, checking council tax and picking delivery slots. Attackers are not trying to be clever about the subject matter. They are trying to get the message into a surface where the usual warnings are thinner.

The auto-add setting is the front door

If your calendar is set to add invitations automatically, you have effectively given unknown senders write access to your diary. That is fine for some teams and a bad idea for most individuals. The safest default is to add events only after you have responded, or only from senders you know.

This matters more on mobile. A phone calendar can surface an event as a notification, and the link inside it may open in a browser with less context than a mail app would provide. If you use the same calendar for work and personal accounts, one loose setting can affect both.

A practical calendar audit

Start with consumer Google Calendar. Open Settings, find the event settings area and look for the option that controls adding invitations to your calendar. Set it to the stricter choice: only when you have responded, or only from known senders. Then check whether any secondary calendars are syncing from sources you no longer recognise.

In Outlook, go to calendar settings and look for events and invitations. Turn off automatic accepting of meeting requests. Check any rules that process invitations automatically. On a work account, ask IT whether external calendar invites are treated differently from internal ones, and whether there is any logging or quarantine for text/calendar content.

On your phone, review which accounts are syncing calendars and whether mail apps are allowed to add detected events. Remove old accounts you no longer use. If your calendar app has a setting for adding events from mail, switch it off unless you genuinely rely on it.

For Google Workspace and Exchange administrators, the job is a bit deeper. Review whether users can auto-add external invitations, and consider transport rules that flag or quarantine external calendar invites containing URLs. Do not block all .ics files; that will break legitimate meeting requests. Instead，log them, test the rules against real business traffic and give users a clear way to report suspicious events.

How to spot a dodgy invite

A few signals are worth checking before you accept anything:

• The invite is unexpected and asks you to sign in, pay or confirm details through a link.
• The organiser display name looks official, but the address behind it does not match the organisation.
• The event has a link in the location or description but no useful context in the body.
• The same event keeps reappearing, or the reminder is designed to create urgency.
• The appointment, delivery or council reference is vague or generic.

What to do when one lands

Don’t use the link in the event. Open the organisation’s official app or type its address yourself. Delete the event and block the organiser if your calendar allows it. Report the message as phishing if you can still see the original email. Then check your auto-add setting again, because one bad invite is a useful reminder that the front door was open.

Your inbox has a spam folder. Your calendar does not. In 2026, it is worth treating it like one.