I Got a Google Calendar Scam Invite. Here’s How to Spot the Fake Voicemail

My phone lit up with a voicemail notification. Nothing unusual, but as I was about to click on the link, I noticed something weird. The notification didn't come from my voicemail app. It came from Google Calendar.

Google Calendar doesn't manage my voicemails, and that was a red flag. I paused to investigate before clicking any links.

It turns out scammers can send fake voicemail notifications through Google Calendar invitations. Depending on your settings, these events can appear on your calendar even if you don't recognize the sender or accept the invitation.

Here's how I spotted the scam, what to do if you receive a suspicious calendar invite, and how to keep unwanted events off your calendar.

How does the Google Calendar voicemail scam work?

Scammers use compromised email accounts or addresses that impersonate legitimate businesses to send Google Calendar invitations. The event title might say "Voice message received" or "A new voicemail is available for playback."

My invitation looked surprisingly legitimate at first glance. It included a genuine Google Meet link, a phone number, and a scheduled time. The description even mimicked a voicemail notification, complete with the message's duration and a "Listen to voicemail" link.

But three details stood out:

• The sender was unfamiliar. Running a business means I often hear from people I don't know, so that alone wasn't suspicious. But when I checked the email address, the domain didn't match the company's actual website. That's a common phishing warning sign.
• The guest list was unusually large. So many people had received the invitation that Google Calendar couldn't display the full list. It looked more like a mass mailing than a voicemail intended for me.
• The voicemail link didn't belong there. Instead of opening my voicemail app or checking messages through my phone provider, the invitation wanted me to follow a link from an unfamiliar sender.

I didn't click the "Listen to voicemail" link, so I couldn't confirm where it led. However, similar phishing attacks use fake voicemail links to send people to convincing login pages designed to steal their credentials.

The most unsettling part? The invitation had appeared on my calendar without my approval. With Google's From everyone invitation setting, someone only needs your email address to send an event that automatically appears on your calendar.

And this isn't an isolated tactic. On September 29, 2026, the University of York warned about fake voicemail calendar invitations targeting Google accounts. The university said some invitations appeared to come from compromised accounts belonging to institutions or known contacts.

In a follow-up security warning on October 13, the university explained that attackers were using convincing fake login pages to compromise accounts after victims entered their credentials.

Fake voicemail notifications are just one example of calendar-invite phishing scams, which use event invitations to deliver malicious links and deceptive messages.

Why are attackers using Google Calendar?

Google Calendar helps people manage their daily lives, so a notification from the app may not immediately raise suspicion. If the invitation appears to come from a colleague, business, or someone you know, it can seem even more trustworthy.

Calendar invitations also give scammers another way to reach you. An event can appear alongside your legitimate appointments, and a notification may pop up on your phone even if you never opened the original invitation email.

That makes the scam particularly easy to overlook: You might assume the event belongs on your schedule simply because it's already there.

What to do if you receive a Google Calendar voicemail scam

If an unexpected voicemail notification appears in Google Calendar, don't click the playback link or enter your login information. Here's what to do instead:

1. Don't RSVP. Avoid clicking Yes, No, or Maybe. Responding to a suspicious invitation can confirm that your email address is active.
2. Check your voicemail directly. Open your phone's voicemail app or your organization's official calling service rather than following the link in the invitation. If the message is legitimate, you should be able to access it through the usual channel.
3. Verify the sender independently. If the invitation appears to come from someone you know, contact them using a phone number or email address you already trust. Their account could have been compromised.
4. Report the event as spam. Open the suspicious event in Google Calendar, select More actions (the three-dot menu), and choose Report as spam if that option is available. This removes the event from your calendar.

What if you already clicked the fake voicemail link?

What you should do next depends on what happened after you clicked:

• If you only opened the link: Close the page without entering information or downloading anything. Clicking a suspicious link doesn't automatically mean your account was stolen, but watch for unusual account activity.
• If you entered your password: Change it immediately through the official Google website, not the suspicious link. If you reused that password elsewhere, update those accounts too. Check your Google Account's recent security activity, signed-in devices, and recovery information for anything unfamiliar.
• If you entered a verification code or approved a login request: Treat your account as potentially compromised. Secure your account, sign out unfamiliar devices, and enable two-factor authentication (2FA) if you haven't already.
• If you downloaded a file: Don't open it. Delete the suspicious download and run an antivirus scan. If you already opened or installed it, disconnect the affected device from the internet while you investigate to limit further damage.
• If it's a work or school account: Contact your IT or security team immediately, especially if you entered credentials. Attackers may use compromised accounts to send additional invitations to your contacts.

You can also review our guide on creating strong passwords to make sure you aren't reusing login credentials across accounts.

How to protect yourself from Google Calendar scams

You can't control who sends a calendar invitation to your email address, but you can control which invitations automatically appear on your calendar. A few additional privacy habits can also make it harder for scammers to reach you.

1. Change your Google Calendar invitation settings

Google Calendar lets you restrict which invitations appear automatically. Here's how to update the setting on a computer:

1. Open Google Calendar and click the gear icon in the upper-right corner.

2. Select Settings, then find Event settings under General.

3. Click Add invitations to my calendar.

4. Choose Only if the sender is known to limit automatic additions to people in your contacts, organization, or previous interactions.

If you want stricter protection, choose When I respond to the invitation in email instead. With this option, invitations aren't added to your calendar until you respond to the invitation email.

Keep in mind that stricter settings add an extra step when you accept legitimate meeting invitations. They also apply to new invitations, not to remove suspicious events already on your calendar.

Google explains these options in its official Calendar invitation settings guide.

2. Use email aliases to limit unwanted invitations

Scammers generally need an email address to send you a calendar invitation. If you use the same address for shopping, newsletters, online accounts, and public contact forms, unwanted senders may find it easier.

Consider using email aliases or masked email addresses when signing up for services that don't need your primary inbox. That way, you can disable an alias if it starts attracting spam without changing your main email address.

This won't prevent scams sent to an address that's already exposed, and some aliases may still forward unwanted invitations. But it's a useful way to reduce how widely you share your primary address. Our guide to avoiding email spam covers more ways to protect your inbox.

3. Verify voicemail alerts through the original service

A voicemail notification shouldn't require you to sign in through an unfamiliar calendar event. If you receive one, open your phone's voicemail app or your workplace's approved calling platform directly.

Don't assume an invitation is safe just because it includes a real Google Meet link, shows a familiar company name, or comes from someone in your contacts. Legitimate accounts can be compromised, and scammers can mix genuine event details with malicious links.

4. Secure your Google account

Even if you never interact with a suspicious invitation, it's worth making sure your Google account is protected:

• Use a strong, unique password and store it in a reputable password manager.
• Turn on two-factor authentication, preferably with a passkey or another phishing-resistant sign-in method when available.
• Review your account's recent security activity and remove devices or sessions you don't recognize.
• Keep your browser, operating system, and security software up to date.

These steps won't stop every unwanted calendar invitation, but they can make it harder for someone to take over your account if a phishing attempt succeeds.

Bottom line

The Google Calendar voicemail scam is sneaky because it puts a suspicious message right alongside your work meetings and dentist appointments. In my case, a mismatched sender domain, enormous guest list, and unexpected voicemail link were enough to raise the alarm.

Changing your calendar invitation settings is one of the most effective ways to reduce unwanted events. Using email aliases, securing your Google account, and checking voicemail through the official app can add extra protection.

Most importantly, don't assume a notification is legitimate just because it appears in an app you trust. If something feels off, verify it before clicking.

FAQs