I stopped calendar spam cold by layering these Google settings on top of each other

A calendar is a list of things you said yes to. At least, that's how I read it and attackers have figured out how useful that assumption is.

Spam filters are good at catching an email promising you a crypto prize or an invoice credit. But the .ics version of that lure takes a different road into your account.

It can bypass the filters and turn into a 9 a.m. Tuesday appointment with your name on it.

Cybersecurity firm Sublime Security says calendar-based phishing is on pace to jump roughly 33,000% between May and September 2026.

Google eventually responded with a dedicated block feature in late summer 2026.

Useful, but partial. So I stacked these settings behind it to stop my calendar becoming an advertising space.

Related

New Google Calendar setting prevents third-party apps from seeing your schedule

Rolling out now

Posts By  Karandeep Singh Oberoi

Google finally added a block button, with a catch

It only works on desktop

Google started rolling out a native block button in Google Calendar in August 2026, and the rollout is still making its way to everyone through September.

Open the event in Calendar on the web, click the three-dot menu, and choose Block.

Google only offers this on a computer, so you won't find it in the Android app.

Better still, the block goes on your Google account's blocklist, so that person is also blocked in other supported Google apps like Chat, Drive, and Photos.

Gmail, however, isn't one of them, so block their address there if you want their emails gone.

There's also a catch. Calendar block only works on other Google accounts. If the invite comes from an Outlook address or any other non-Google account, that button can't help you.

Stop non-Google spammers at the Gmail door

Send them straight to Spam

When the fake crypto webinar invite comes from a non-Google address, you have to block spammers upstream.

Google acknowledges this. If a spammer isn't using a Google account, the company says your best bet is to block them in Gmail.

Open the associated email, use the three-dot menu, and choose block sender. That creates a rule that sends everything from that address straight to Spam.

If you also want to flag the message to Google, use Report spam or Report phishing.

Since the message never reaches your primary inbox, the invite never gets the chance to cross over into Calendar, which patches the gap the Calendar-side button left open.

Only let known people onto your calendar

New contacts will have to wait

Blocking individuals is reactive. By the time you block someone, they have already reached you.

The setting that keeps them out is in Calendar settings under Add invitations to my calendar. Switch it from the default to Only if the sender is known.

After that, Calendar auto-adds an event only when the sender is in your contacts, shares your organization's domain, or is someone you've emailed before.

Everything from strangers remains parked in your email until you look at it yourself.

Google thinks this is important because in August 2026 it gave Workspace administrators the option to enforce the setting across corporate domains. Personal accounts can use the identical logic.

Yes, it makes things slightly harder for legitimate first-time business contacts, but I'd rather email someone back than let anyone with my address write to my week.

Gmail's event parser can be fooled by fake receipts

Decide if the convenience is worth the risk

Google built an automated parser that reads your mail and drops events such as flight confirmations and hotel bookings onto your calendar, and I know that's convenient, but it can be abused.

Criminals dress up phishing emails as receipts and booking confirmations, and if the parser takes the bait, the fake event lands on your calendar looking as legitimate as your real flight.

Attackers can even hide malicious prompts inside calendar descriptions to get Google Gemini to take unauthorized actions. The term for it is promptware and prompt injection.

When Gemini reads those instructions inside an invitation, it can be pushed into writing phishing emails or anything the attacker wants.

Your assistant becomes the attacker's assistant.

Killing this means giving up something you probably like, so it's your choice.

On Android, open Calendar settings, tap Events from Gmail, and turn off Show events from Gmail.

On the web, the same checkbox is under Google Workspace smart features. To stop Gmail from creating them at all, you'd have to turn off Workspace smart features.

Ignore it or block it, but don't answer it

Block the sender ASAP

Say a fake meeting makes it past the filter and shows up in your pending queue. Your instinct is to decline it and move on, and I get it, but that's probably the worst thing you could do.

Interacting with a spam invite confirms to the attacker that your address is valid and actively watched.

A decline is still a response, and it promotes you to a higher-value target for the next campaign. The safe move is to set it to show only invitations you've responded to or block it.

Google's defaults favor convenience over safety

Nobody should need five settings menus to keep fake invoices off a personal schedule.

But calendar protocols still lag behind email in threat detection, and default configurations still prioritize easy scheduling and productivity over safety.

Attackers will keep exploiting that gap for as long as it stays open. Locking this down takes about 10 minutes. Make sure you start right now.