Spam iCloud Calendar Invitations

Question

Today I've suddenly received spam calendar invitation for $19.99 Ray Ban sunglasses (never subscribed, checked, searched or visited any related site, so clearly spam) and it has other visible email accounts within the invitation.

I'm wondering if I should be worried whether my accounts been compromised or a simple email from anywhere just plops this in my calendar without review.

Questions to be answered:

1. What should I check/setup in order to make sure my iCloud account is safe?
2. How can I delete this invitation without sending a notification to the sender, so as to prevent them from knowing my email address is live?
3. How can I prevent these notifications in the future?

Here's an image:

Answer 1

Regarding how to prevent this in the future (question #3):

1. Log in to iCloud Calendar on a computer web browser

2. Authenticate if needed, then select the Calendar view

3. Select the Settings Gear icon ⚙ in the bottom left corner then hit Preferences...

4. Select Advanced

Choose the option to receive calendar invitations by email instead of allowing the server to insert them without review into your calendar:

5. Select Email to [youremail] instead of In-app notifications

You now get to decide and delete or process calendar spam like regular email spam, allowing you to filter out these spam calendar invitations systematically.

Answer 2

I've had the exact same email. I've managed to get rid of it by doing the following:

1. Create a new iCloud calendar - I called mine junk
2. Move the spam invite to the new Junk calendar
3. Delete the newly created Junk calendar with the spam appointment in it - ensuring you select the 'Delete and Don't Notify' option in the Dialog box that appears.

This worked for me - I hope it works for you too.

Answer 3

Apple made a 'report junk' button inside the calendar app on iCloud.com - when you report an invite it will be deleted across all synced calendars.

If you get an invitation that you think is junk or spam, you can report it to iCloud.

1. Sign in to iCloud.com with your Apple ID, then click Calendar.
2. Open the event you want to report, then click Report Junk.
3. Click OK.

The event is automatically deleted from your calendar on all your devices where you’re signed in with the same Apple ID.

Answer 4

This doesn't currently seem possible using the accepted answer, at least if the inviter is in your contacts - it needs some sort of action from Apple. Please make a comment if there is extra privacy against invites from people not in your contacts (I thought it worth making an answer for this, given that information still seems to leak).

I tried the accepted answer: sent an invite to my iCloud account from a different iCloud event and followed the accepted answer. The sending account saw the event as declined. It's not clear whether spammers can see this using their method but it's definitely possible that they can.

I also tried moving the invite into a Junk calendar without deleting it and even this action can be seen - the inviter sees something like "Deleted from Home".

Answer 5

With regard to #2 (how to delete without sending a notification to the sender) -- I don't have an answer yet, but I can confirm that the up-voted answer from Jackal above ("move spam event into temporary calendar, then delete temporary calendar") still sends a DECLINE to the sender.

Understandably many folks here and in other social media venues that are sharing the workaround have merely trusted the "Delete and Don't Notify" button on the calendar-with-open-invites-delete warning to do what it says it does.

This, however, is Stack, where we should promote testability, repeatability and empirical evidence in general.

This is simply tested and currently repeatable on latest build of macOS and Calendar at this time of writing: simply have another iCloud user send you an invite, and have them watch your acceptance-status change from NO REPLY to DECLINED, the moment you click "Delete and Don't Notify" on for that temporary calendar.

So far, @AppleSupport has yet to respond with anything except "PM us with your device and OS versions."

In the meantime, I have 5 spam invites filling my calendar that I'm not touching.

And no, I am not interested in turning OFF the direct-from-email-to-calendar feature, as it is a good feature, it just needs "show invites in calendar automatically, but only for senders in my contacts" and a "swipe-left-to-delete-the-invite" ... and then actually NOT send a decline.