Apple's New Calendar Feature Unleashes Appointment Spammers

When Apple updated their operating system to include automatic searches of your email for appointments, which are then added to your calendar, they assumed automating this process would make life a little bit easier.

But spammers are taking advantage of it.

A rash of customer complaints are pouring in lately because spam emails are including false appointment information, which then show up on your Apple Calendar app as fake appointments. Examples included sales on Ray-Ban sunglasses, Ugg slippers, and financial seminars. On Calendar, they appear with a dialog box on the upper right of the screen, asking if you wish to accept or decline the appointment.

Annoying, but the worst part is that declining the appointment sends a notification back to the spammer — who now knows that your email address is active, and a target for more frequent spam.

Apple has acknowledged the problem, and apologized:

We are sorry that some of our users are receiving spam calendar invitations. We are actively working to address this issue by identifying and blocking suspicious senders and spam in the invites being sent.

This does not appear to be a problem that will have a simple fix. You know how difficult it is to successfully weed out spam in our email; now that problem has been ported to your calendar.

The calendar invitation appears as a result of a setting in your Calendar on iCloud, which syncs your Calendar, Mail, and Contacts among all of your Apple devices.

There are two ways to eliminate the problem: you can turn off the in-app notifications; or you can move the spam appointments to a new calendar that you create, and then delete the calendar.

For the first solution, go to icloud.com, sign in, and open the Calendar page. Go to the Settings icon in the lower left of the window (the gear icon), choose Preferences, then Advanced, then scroll down to Invitations. Choose the option that sends invites to your email, which deselects the in-app notification option.

The second approach: create a new calendar called Spam. When a spam appointment comes in, don’t accept it — just drag it to the Spam calendar.

This reveals how difficult it is, even for a firm with the resources of Apple, to develop features that add convenience without creating unintended consequences. As long as bad actors want to get your attention, these artificial intelligence developments can be abused.

When I first was alerted to leave for an appointment by Google, I thought of how amazing it was. On its own, software found an appointment on my calendar, determined where it was, determined where I was located, checked the directions and traffic, and figured out when I needed to leave.

But occasionally, I have an appointment for a phone conference that contains an address of one of the attendees, and it will err in assuming the meeting is there, with the accompanying recommendations on traffic and when to leave.

I also use Tripit, which keeps track of my travel itineraries and sends notifications of check-in times for flights. Recently, it alerted me to a flight I was not scheduled to take: it had found the flight in the body of an email misaddressed to me.

I hate to imagine what a spammer could do with access to your travel information. With this push to intelligently decipher and automate your life, bad actors could cause more serious havoc as they also get more sophisticated.