You open your calendar on a Monday and there is a meeting on it you never accepted. A vendor you have never spoken to has booked thirty minutes of your Thursday. Sometimes it is a webinar. Sometimes it is a "quick intro." You did not reply to an email, you did not click anything, and it is on your calendar anyway.
This is a real sales tactic, it has been argued about in sales communities for years, and the people on the receiving end of it are not enjoying it. In the Bravado sales community the practice gets called greasy, and one seller on the receiving end put it plainly: there is not a faster way to tell you that I will not work with you. A 2015 post on the sales blog Don on Selling called it kind of creepy, and a borderline invasion of privacy when you put a meeting invite on the calendar of someone you have never spoken to.
Sellers who defend it report mixed results, and mostly on prospects who had already engaged and then gone quiet rather than on cold strangers. Take that defense seriously anyway, because the version that works at all works for one reason: the tactic works exactly to the degree that people stop reading their calendar carefully.
That is also the part that should concern you, and it has nothing to do with sales etiquette.
The same door, used by two different people
On August 6, 2026, Barracuda published an analysis of calendar invite phishing, updated on September 17. Barracuda reports that attackers are using calendar invites and .ics files to get past defenses built around email.
Here is why that works, in Barracuda's words. Calendar invites "are often added automatically to the user's calendar with little or no interaction from the recipient," and they "often persist even if the original email is deleted or quarantined." Because the content sits inside calendar metadata rather than the email body, "some security controls may not inspect it as thoroughly."
So an attacker can put a phishing link in an event description, hide a URL in the location field, attach a file, or drop in a QR code that a link scanner may not decode. Barracuda notes that the QR approach is deliberate: the destination sits inside an image, users cannot easily inspect it before visiting, and it pushes the person onto a phone, where links are often opened outside monitored desktop environments.
The themes are chosen to be boring. Barracuda lists HR policy updates, employee handbook reviews, benefits enrollment, compliance notifications, and payroll or administrative actions. Few people look twice at a benefits enrollment reminder. If the person enters credentials and approves the multifactor prompt on the page they land on, Barracuda describes attackers capturing the username, the password and the authentication session data, which is enough to get into the account.
Now read that list again next to the sales tactic. The marketer and the attacker are using the same delivery mechanism, relying on the same default behavior, and counting on the same thing: that a calendar entry does not get the scrutiny an email gets.
Why this is worse than an annoying inbox
A cold email is annoying. Your staff delete it and nothing has changed about how they think.
An unsolicited calendar invite is different, because it moves the baseline. When a legitimate company puts an unrequested meeting on someone's calendar, it teaches that person that unrequested meetings on the calendar are a normal part of business. That is the exact instinct security awareness training spends money trying to build in the opposite direction.
We are not accusing anyone of anything. The sales teams doing this are not attackers and the practice is not illegal. But the effect on your people is the same either way, and it accumulates.
What you can actually change, and where you cannot
This is where the two big platforms part company, and the difference matters more than any single checkbox.
Google Workspace and Gmail give you a real control. By default, "all invitations are automatically added to your calendar." Google shipped an alternative on July 20, 2022. In Google Calendar on the web, open Settings, then General, then Event settings, find "Add invitations to my calendar," and choose "Only if the sender is known." Invitations from people in your contacts, inside your organization, or who you have interacted with before still arrive normally. Everything else comes in as an email and only reaches your calendar if you say so. Google admins can set this across the whole domain from the Admin console, so this does not have to be chased person by person.
Two caveats worth knowing before you flip it. Google warns the setting "might reveal to senders that they aren't in your contacts." And it is not retroactive: your updated settings apply only to new invitations, so anything already sitting on the calendar stays there until it is removed.
Microsoft 365 does not have an equivalent. This is the part most people get wrong, and we nearly got it wrong ourselves. There is a setting called "Events from email" that sounds like the answer, and it is not: its scope is reservation messages, meaning flights, hotel bookings, rental cars, package deliveries, bills and dining reservations.
Turning it off does nothing to a stranger's meeting invite. It is also unavailable in Office 365 Government plans and cannot be changed from Outlook for Windows at all.
Unchecking client-side automatic processing does not solve it either. On a normal user mailbox, Exchange places an incoming meeting request on the calendar as tentative on the server side, before anybody in Outlook has decided anything.
So for Microsoft 365 the honest answer is that the lever is not a calendar checkbox. It is the mail layer that the invite arrives through, and what you tell your staff.
Tell people the reason, not just the setting. The instruction that lands is short: a calendar entry is not proof that a meeting is real, and a QR code inside a calendar event is not something to scan on a phone.
Where we fit
Our Managed Email Security runs on Check Point Email Security, connected to Microsoft 365 or Google Workspace through the API, with no change to your MX records. Per Check Point, in inline mode it acts as a defense layer after the Microsoft 365 or Google Workspace mail gateway and before inbox delivery.
There is one thing it does that is directly on topic here. Per Check Point, in Microsoft 365 the platform automatically removes a malicious calendar invitation when the phishing email that carried it is blocked. That addresses the persistence problem Barracuda describes, where the calendar entry outlives the message.
We are not going to claim more than that. Barracuda's lead recommendation is to treat calendar invites as active content and inspect .ics files with the same scrutiny as attachments, alongside phishing-resistant multifactor such as FIDO2 or WebAuthn. Those are the right goals, and inspecting .ics files is Barracuda's recommendation rather than a capability we claim today.
What we do is the part that tends not to happen on its own: we tune the email security policy as the technique changes, investigate anything a staff member reports, act on what got through, and walk your team through how to report it. Where a tenant setting needs changing, we tell you which one and change it with your approval.
New customers also get a written SaaS security posture report inside the first 90 days at no charge. It covers multifactor coverage and conditional access or context-aware access rules, admin and emergency access accounts, automatic external forwarding rules, external sharing and link settings, the allow lists in your mail platform, third-party app permissions, and email authentication (SPF, DKIM and DMARC). It says what is switched on, what is switched off, and what we would change with your approval.
To see what is reaching your people before deciding anything, our free two-week email security assessment runs alongside your current filter in Monitor only mode, and during the assessment we do not quarantine, move, or delete messages. At the end you get a written report and a walkthrough using your own examples.
The year-end offer
Managed Email Security is $8 per user per month, license and fully managed service together. Through December 31, 2026, new customers who sign a 12-month agreement get 20% off, which is $6.40 per user per month. Registered 501(c)(3) nonprofits get 30% instead, which is $5.60. The nonprofit rate replaces the standard discount rather than stacking with it. New customers only, no onboarding fee, and the posture report inside the first 90 days at no charge. Full terms are in the year-end offer post.
We work with small and medium businesses and nonprofits nationwide from our home base in McLean, Virginia, including Washington DC, Northern Virginia, and Maryland.
If you are on Google Workspace, go and change that setting first whether or not you ever speak to us. If you are on Microsoft 365, the honest answer is that there is no equivalent switch, which is a reason to look at the layer in front of it. To talk it through, book a free 15-minute call.
Sources: Barracuda blog, "Calendar invite phishing: How attackers abuse .ics files" (Aug 6, 2026, updated Sep 17, 2026). Google Workspace Updates, "Prevent spam by adding invitations from known senders only to your calendar" (July 20, 2022), and Google Calendar Help, "Manage invitations in Calendar." Microsoft Support, "Automatically add events from your email to your calendar," and Microsoft Learn, Set-OrganizationConfig (EnableOutlookEvents). Check Point Email Security solution materials. Bravado War Room discussion of ghost calendar invites, and Don on Selling, February 1, 2015.
