An unfamiliar meeting, Norton renewal or Geek Squad invoice in your calendar can be an attempt to draw you into a phishing link or fake support call. First separate what the event claims from what your account and financial records actually show.
Quick answer: An unexpected calendar entry alone does not prove a purchase, debt or account takeover. Check renewal claims independently. Use your calendar’s own removal or reporting controls, without following the event’s links, calling its number or installing its suggested software.
Why did an event appear without my permission?
Start by identifying where it came from. An invitation sent to your email, an unwanted calendar subscription and an app with calendar access need different remedies.
| What you see | What to check | Removal approach |
|---|---|---|
| One invitation or recurring invitation series | The event’s organizer and calendar | Use the event’s reporting or deletion controls. |
| Many entries in an unfamiliar subscribed calendar | The calendar list and subscription name | Unsubscribe from that unwanted calendar. |
| Events returning after invitation settings change | Which apps can write to your calendar | Review permissions through device settings. |
Google’s invitation settings can automatically add events from everyone, known senders, or only after an email response. This explains why an unsolicited event can appear without proving someone signed in as you.
Fake renewals, login links and software downloads
In research published September 17, 2026, Sublime documented a Google Calendar invitation using a false payment and credit-note claim. Its link led to a download of ScreenConnect, a legitimate remote-management tool configured for malicious use. The number of targets was not disclosed.
The abuse of familiar services does not make those service providers fraudulent. A Google-hosted invitation can still contain a dangerous destination. A renewal notice can also try to get you to call an impersonator rather than download anything directly.
The FTC describes fake tech-support renewal notices using brands including Norton, McAfee and Geek Squad. Check your real subscription account and financial statement through an independently opened app or website. Our Geek Squad renewal guide explains the related fake-invoice and refund-call tactic.
Do not install a “refund” tool: An unexpected invitation is not a reason to give a stranger remote access, disclose a security code or transfer money. A familiar logo or invoice amount does not authenticate the request.
Remove or report an event in Google Calendar
Google’s computer instructions say to open Calendar, select the suspicious event, then choose More actions → Report as spam. Reporting removes that event and, for a recurring invitation, its series.
This reporting option applies to events sent from Google Calendar. It is not available for every event created by another provider, app or service. If it is missing, identify the source and use that provider’s appropriate removal route. Viewing event details to reach the controls is different from opening a link inside the invitation.
Reduce automatically added Google invitations
On a computer, go to Settings → Event settings → Add invitations to my calendar. Choose Only if the sender is known, or use When I respond to the invitation in email if that better suits your needs.
Known senders include contacts, organization members and people you have interacted with; this is not a guarantee that every added event is safe. Changes apply to new invitations. Work or school administrators may limit your options. If unwanted events persist on Android, review which apps have calendar access, as Google recommends.
Remove unwanted iPhone calendar events
Apple’s instructions for iOS 26 or later distinguish individual events from an entire calendar:
- Single event: In Calendar, tap the event and use Delete Event, then confirm. For an event from an unknown contact, use Report Junk → Delete and Report Junk when offered.
- Unwanted subscription: Open Calendars, tap the information button beside that specific calendar, then choose Unsubscribe and confirm.
Check the calendar name first: Removing an entire calendar affects its collection of events. Use the individual event controls when only one invitation is unwanted; do not delete a legitimate personal or work calendar to remove it.
What to do after interacting with the invitation
- Only viewed the event: Remove or report it. Its presence alone is not evidence of a charge or successful compromise.
- Opened its link: Close the page and avoid entering information, downloading files or approving permissions. Check whether anything downloaded or any permission was granted.
- Entered credentials: Change the affected password through the genuine service, address reused passwords and enable two-factor authentication. Google’s compromised-account guide also explains how to review security activity, devices and recovery details.
- Installed software or allowed remote access: Seek trusted technical help to remove unwanted access and check the device. The FTC’s recovery instructions advise updating security software, scanning and removing detected problems, and securing accounts. If this is a work device, notify your IT team.
- Paid or disclosed banking information: Contact your bank or payment provider through a trusted channel promptly. Explain what happened and ask about securing the account and reversing any payment.
Calendar scam FAQs
Does a calendar invitation mean my account was hacked?
Not by itself. Invitation settings can allow unsolicited events to appear. Separately investigate unfamiliar sign-ins, changed recovery details or other account activity.
Did the renewal event charge my card?
A calendar entry does not establish a completed payment. Check your actual account and statement independently before acting on its claim.
Should I delete one event or unsubscribe?
Remove the individual event or series if that is the source. Unsubscribe only when you identify an unwanted calendar subscription containing the entries.
Does deleting the event undo a stolen password or installed program?
No. Removing the invitation cleans up the calendar. Credentials disclosed, permissions approved or software installed require separate recovery steps.
Official instructions and research checked October 13, 2026. This guide does not claim a verified October consumer-loss cluster. ThinkItsAScam.com is independent of the services mentioned.
Leave a Reply