up vote 121 down vote favorite
19

Today I've suddenly received spam calendar invitation for $19.99 Ray Ban sunglasses (never subscribed, checked, searched or visited any related site, so clearly spam) and it has other visible email accounts within the invitation.

I'm wondering if I should be worried about this? Has any of my accounts been compromised or is it as simple as they have my email from anywhere and sent out an invitation like any spam email?

Questions to be answered:

  1. What should I check/setup in order to make sure my iCloud account is safe?
  2. How can I delete this invitation without sending a notification to the sender, so as to prevent them from knowing my email address is live?
  3. How can I prevent these notifications in the future?

Googled this problem but couldn't really find anything.

Here's an image:

enter image description here

share|improve this question
  • Could this have resulted from your account being hacked during the massive Yahoo hack? – NoahL Oct 23 '16 at 21:44
  • Don't think so. I've changed my password immediately after the news had started to spread. But it's a good point! This is probably how they've got my address. – Denis Rasulev Oct 23 '16 at 21:49
  • Same thing just happened to me today, for the first time. I have a secure iCloud password and don't reuse it on any other sites. – Craig Otis Nov 1 '16 at 17:42
  • 1
    the calendar invite does show the other victims too. it just looks like brute-forced email-guessing. Apple just needs to do better filtering – Steven Lu Nov 26 '16 at 5:42
  • 1
    I can't believe that Apple still hasn't resolved this problem – Casebash Nov 27 '16 at 12:35
up vote 97 down vote accepted
+50

Regarding how to prevent this in the future (question #3):

  1. Log in to iCloud Calendar on a computer web browser

  2. Authenticate if needed, then select the Calendar view

  3. Select the Settings Gear icon ⚙ in the bottom left corner then hit Preferences...

preferences

  1. Select Advanced

Choose the option to receive calendar invitations by email instead of allowing the server to insert them without review into your calendar:

Email invitations setting

  1. Select Email to [youremail] instead of In-app notifications

You now get to decide and delete or process calendar spam like regular email spam, allowing you to filter out these spam calendar invitations systematically.

share|improve this answer
  • I've checked today - and it appeared that this option was set up exactly as you write BEFORE I got that spam into my calendar. So I think that this won't help to avoid it in the future... :( – Denis Rasulev Nov 4 '16 at 8:08
  • Thanks, this exactly worked for me. I found I could not move the Spam calendar event to a new Calendar because the mechanism was done directly in iCal and I did not have permissions to write to the spammer's calendar. But once I changed the event notifications to be via email, I found it not only prevented future instances, but, also allowed me to delete the existing events because the "decline" was now sent via email. This answer is actually the real fix. (except for the part where Apple has to now have a "spam calendar event" button). – scot Nov 5 '16 at 21:59
  • 2
    This is the best answer for preventing future spam. Thank you. – Caimen Nov 11 '16 at 19:28
  • 2
    @RLH - Make sure you're in the calendar preferences, not the general iCloud settings - I made that mistake. – Sperr Nov 25 '16 at 5:06
  • 1
    The iCloud.com Calendar interface now lets you report invitations as spam. – Paul D. Waite Dec 13 '16 at 12:18
up vote 69 down vote

I've had the exact same email. I've managed to get rid of it by doing the following:

  1. Create a new iCloud calendar - I called mine junk
  2. Move the spam invite to the new Junk calendar
  3. Delete the newly created Junk calendar with the spam appointment in it - ensuring you select the 'Delete and Don't Notify' option in the Dialog box that appears.

This worked for me - I hope it works for you too.

share|improve this answer
  • Hmmm... Nice idea, though didn't work for me :( Actually, since I did not reacted to the invitation in any way (neither accepted it nor declined) I cannot move it anywhere, but only copy it. Which does not help :(. How did you moved this spam invitation to other calendar? – Denis Rasulev Oct 24 '16 at 10:23
  • The suggestion of moving calendars worked perfectly for me. If you go into calendars click at the bottom to show all, if you edit you can add a new one to iCloud called spam. Then go to the spam invite it shows which calendar is assigned to click that and select the new one. Then go back to Show all calendars and delete the Spam grouping , it says it deletes all emails associated. – Tigger Oct 24 '16 at 13:06
  • 8
    I made sure I didn't react to the invite either - didn't want to acknowledge that they'd found a real account and then get inundated with more spam. Once I'd created the new Junk calendar I went back to the invite, right clicked, selected calendar and then the new Junk calendar from there. This transferred the spam invite without responding to it. Since it was the only item in the new calendar I just deleted the whole calendar! – Jackal Oct 24 '16 at 13:29
  • 3
    How do you know for sure that no response is sent? – Sam Brightman Nov 23 '16 at 4:30
  • 15
    This is not good advice. I checked this using an iCloud invite from another account - the dialogue that comes up when you delete the junk calendar offers the option to delete the calendar and not notify. However, my status is updated to declined in the calendar of the person who sent the invite. It is possible that spammers can still detect your email address is real if you use this. – Sam Brightman Nov 23 '16 at 14:59
up vote 10 down vote

Apple made a 'report junk' button inside the calendar app on iCloud.com - when you report an invite it will be deleted across all synced calendars.

If you get an invitation that you think is junk or spam, you can report it to iCloud.

  1. Sign in to iCloud.com with your Apple ID, then click Calendar.
  2. Open the event you want to report, then click Report Junk.
  3. Click OK.

The event is automatically deleted from your calendar on all your devices where you’re signed in with the same Apple ID.

Screenshot iCloud.com Calendar

share|improve this answer
up vote 7 down vote

This doesn't currently seem possible using the accepted answer, at least if the inviter is in your contacts - it needs some sort of action from Apple. Please make a comment if there is extra privacy against invites from people not in your contacts (I thought it worth making an answer for this, given that information still seems to leak).

I tried the accepted answer: sent an invite to my iCloud account from a different iCloud event and followed the accepted answer. The sending account saw the event as declined. It's not clear whether spammers can see this using their method but it's definitely possible that they can.

I also tried moving the invite into a Junk calendar without deleting it and even this action can be seen - the inviter sees something like "Deleted from Home".

share|improve this answer
  • 1
    This is not an answer, it should be a comment. – Todd Wilcox Nov 25 '16 at 17:54
  • 3
    It's somewhere in-between. Based on what I've seen, the accepted answer is wrong and the current answer to most of the question is "no, it's not possible to prevent this". Answers can change over time if new information comes to light. – Sam Brightman Nov 25 '16 at 18:04
  • 1
    I agree the accepted answer is less than ideal. I've put a bounty on the answer currently with the most votes to indicate it's a nice way to prevent this class of nuisance as opposed to dealing with each instance. – bmike♦ Nov 26 '16 at 14:37
  • @bmike 1. I've changed accepted answer (didn't know this was possible) so your comment / bounty may need to be updated, if so is required. 2. By the time previous answer was accepted, it was the only one that solved the problem. 3. Is there a need to change question / answers so they could be more helpful to the community? – Denis Rasulev Nov 26 '16 at 23:22
  • @DenisRasulev - you can always change the accepted. Bounty will help others see the fix so o harm there (that I see). I don't see any need for edits. Good questions though. – bmike♦ Nov 27 '16 at 2:57
up vote 2 down vote

With regard to #2 (how to delete without sending a notification to the sender) -- I don't have an answer yet, but I can confirm that the up-voted answer from Jackal above ("move spam event into temporary calendar, then delete temporary calendar") still sends a DECLINE to the sender.

Understandably many folks here and in other social media venues that are sharing the workaround have merely trusted the "Delete and Don't Notify" button on the calendar-with-open-invites-delete warning to do what it says it does.

This, however, is Stack, where we should promote testability, repeatability and empirical evidence in general.

This is simply tested and currently repeatable on latest build of macOS and Calendar at this time of writing: simply have another iCloud user send you an invite, and have them watch your acceptance-status change from NO REPLY to DECLINED, the moment you click "Delete and Don't Notify" on for that temporary calendar.

So far, @AppleSupport has yet to respond with anything except "PM us with your device and OS versions."

In the meantime, I have 5 spam invites filling my calendar that I'm not touching.

And no, I am not interested in turning OFF the direct-from-email-to-calendar feature, as it is a good feature, it just needs "show invites in calendar automatically, but only for senders in my contacts" and a "swipe-left-to-delete-the-invite" ... and then actually NOT send a decline.

share|improve this answer
  • Down-voters ... care to elaborate on that choice? Other comments mention the same thing, but at the comment level, they're not being seen, and folks coming here for good advice, are not noticing the BAD and un-tested advice that's been voted up. Unconcerned with down vote, very concerned with bad advice being continually passed around. – storsoc Nov 29 '16 at 23:00

protected by Community♦ Oct 28 '16 at 14:33

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.