Email spam is bad enough. But now spammers are turning to calendar invites to push their products using bogus event invitations. iCloud users have recently seen a huge surge in the practice, and most Mac and iOS users have Apple’s calendar enabled by default.
Notifications for these bogus events will appear on all iCloud-enabled devices. Don’t simply click “Decline” on the event invitation — there’s a right and a wrong way to deal with calendar spam.
Where Did It Come From?
The latest wave of calendar spam to target iCloud users came from China, trying to shift fake Ray-Ban and Oakley sunglasses over the 2016 Black Friday weekend. Though Apple can restrict how frequently calendar invitations can be made using flood detection, if the spammer creates lots of accounts then they can circumvent this restriction.
That’s why you’ll get invitations from randomly generated names like “bdrtrvn” but it’s also likely many of these requests came from different IP addresses to further fool Apple’s spam detection. Apple proudly states that they encrypt almost all information stored within iCloud, but this means they can’t read your calendar information.
As such it’s not possible to identify spam using the usual pattern detection used by email spam filters. You can’t just scan calendars for invites that use a particular phrase, so it’s harder to remove the unsolicited requests. Locking down calendar invites to known users only would essentially defeat the point of such a feature, which many rely on for business, press, and even events with well-organized family and friends.
Delete Spam the Right Way
There are a few ways to get rid of the offending invite, but there’s one important thing to remember: if you simply refuse the invitation by clicking Decline, you will send a notification to the spammer informing them that you are a real person and that your email address is a valid one. That’s valuable information to those blindly targeting as many email addresses as they can, and potentially opens you up to more spam in future.
Delete via iPhone:
- Open the Calendar app and tap Calendars at the bottom of the page.
- Tap Edit in the top left corner, scroll down to “iCloud” and tap Add Calendar.
- Call your new calendar “Spam” or something like that (name doesn’t really matter, you’ll be deleting it anyway) and hit Done, then Done again.
- On the main Calendar screen hit Inbox in the bottom right corner.
- Tap on the event name (but don’t hit Accept, Maybe or Decline) then tap Calendar.
- Choose the “Spam” calendar you created in step three, then hit Done and repeat for any other requests.
- Go back to the main Calendar screen, hit Calendars at the bottom again, followed by Edit.
- Select the “Spam” calendar you created, scroll to the bottom of the page and hit Delete Calendar. Choose “Delete and Don’t Notify” if you get a prompt.
Delete via Mac Calendar:
- Launch the Mac Calendar app and head to File > New Calendar.
- Give it a name like “Spam” or something similar. Make sure other iCloud calendars are visible by checking the box next to their names.
- Find the fake spam invitations on your calendar (they will appear in a faint gray, with a dashed outline), double click them and use the colored square in the top-right corner to assign them to the “Spam” calendar you just made.
- Repeat for any other fake event invitations you have received, then right click (or two-finger click) on the “Spam” calendar and click Delete. Choose “Delete and Don’t Notify” if you get a prompt.
Delete via iCloud.com:
Note: I’ve read it’s also possible to perform the same Calendar switch-and-delete trick using iCloud.com. But I can’t seem to get the events to move to the “Spam” calendar. This could be a temporary issue with iCloud, or it might simply not work via the web interface. If you want to give it a try, here’s how it should work:
- Head to iCloud.com and login using the affected Apple ID.
- Choose Calendar then click on the gear icon and select New Calendar.
- Give your calendar a name like “Spam” and make sure your other iCloud calendars are visible by checking the box next to their names.
- Find the fake spam invitations, double click them, then use the colored box in the top-right corner to reassign them to the “Spam” calendar you just created.
- Repeat for any more fake events, then hit Edit followed by the red icon that appears next to the “Spam” calendar you created.
- Choose Delete and hit “Delete and Don’t Notify” if you get a prompt.
Turn Off iCloud Calendar
If you don’t use your iCloud calendar at all (maybe you’re fond of Google Calendar or one of these fantastic replacements) then you can disable it on all your devices. It will still be there in the background, but you won’t hear anything about it.
To disable iCloud Calendar on an iPhone: Head to Settings > iCloud and toggle Calendar to off.
To disable iCloud Calendar on macOS: Head to System Preferences > iCloud and uncheck the box next to Calendar.
Prevent Spam Invitations in the Future
You can still prevent spam invitations reaching you if you keep iCloud enabled. Just opt to receive them as email instead. There’s the added benefit of your internet spam filter, and you can just delete the message from your inbox without having to decline in the manner described above.
Just be aware that once you’ve opted to do this, you won’t receive any invitations via your Calendar apps — you’ll have to accept all invitations via email including the legitimate ones. If you don’t rely on the feature this may not be such a big deal.
Disable iCloud Calendar Invitations:
- Head to iCloud.com from a web browser and login with your Apple ID.
- Click on Calendar, click the gear icon in the bottom left and choose Preferences.
- On the Advanced tab change “Receive event invitations as:” to Email to <email address> and click Save.
It’s Not Just iCloud
Event spam is nothing new, and it’s not only iCloud that’s affected. Google Calendar, the most popular choice for sharing and organizing events, suffers at the hands of spammers too. The recent prevalence of iCloud spam does seem to suggest that the problem is getting worse though, so it will be interesting to see how Apple responds to the problem.
Have you received calendar spam via iCloud or another provider? How did you deal with it? Let us know if you’ve been affected in the comments below.