UPDATE Dec 11, 2016: Apple has updated the calendar app to allow users to report calendar items as spam, which will remove said spam from your calendar and alert Apple with details about the spammer. MacStories has a great article that goes into more details about these brand new features.
Feel free to read my original article below, but with Apple's new fix the temporary fix detailed below is no longer needed...
I had a first this week...I received my first ever iCloud calendar invite spam. What the hell is that you say?
Needless to say, I didn't create a calendar item to remind me to go buy Oakley or Ray-Ban sunglasses over the next couple of days. No, I was the victim of calendar spam. It's essentially email spam, but a lot more devious. You see, these spammers have figured out a weakness in Apple's iCloud calendar settings. By default when you are sent an invitation to your iCloud account it is automatically added to your calendar. For someone that isn't used to dealing with corporate calendar systems this is actually a really nice feature because you don't have to understand or even care about what a calendar invite is. That is until you get spammed.
So here is how it works. Somehow some spammer out on the internet has found a bunch of iCloud email addresses. They then send out calendar invites to those iCloud addresses. Not emails mind you, just calendar invites. Because the default settings on the iCloud calendar automatically accepts all calendar invites and adds them to your calendar, this event and any alerts associated with the event just show up on your calendar. If you do anything to the calendar item (accept or decline) you are essentially telling that spammer that they found an active account...so don't do anything. Leave the invite where it is and make a very simple change to your iCloud calendar settings. Here is how you do it:
- Go to icloud.com and login to your iCloud account
- Navigate to the Calendar App
- Click in the settings (gear icon) in the lower left of the screen
- Select "Preference" from the menu
- Select the "Advanced" tab
- Under the "Invitations" section select the "Email to" options (see the screenshot below)
To be clear, by making this change to your iCloud calendar settings you are keeping this sort of thing from happening in the future. This doesn't get rid of your current calendar spam. I would suggest just leaving the spam event as-is so you don't alert the spammer on the other end that you are a valid and active iCloud account. With the changes you have just made, all future calendar invites you receive will come in the form of an email now. This does two things. It will give you the option to accept the invite (which adds it to your calendar) or ignore it (and it won't get added to your calendar). The other thing it does is it now exposes any calendar invites you receive to Apple's spam filters which will most likely block these types of invites.
So enjoy your spam free iCloud calendar and let me know if you are in the market for some sunglasses...
Update...a few days after I originally wrote this post an article from The Sweet Setup showed up in my RSS feed and it highlighted a method covered over on tom's guide about how to safetly delete a spam invite. So now, not only can you prevent this from hapenning in the future you can also nuke the spam you already have (and this method doens't alert the spammer that you have done it). Here is how to do it:
- Go into the Calendars app and select the "Calendars" button (which is at the bottom of the screen on iOS and at the top left on the Mac)
- Select "Edit" (to add a calendar on the Mac select "File" from the menu and then "New Calendar")
- Select "Add Calendar"
- Name the new calendar something fun like "Spam Sucks", not because you need to but because it might make you feel better
- Go into the spam invitiation (or invitations if you are cursed enough to have multiple) and tap "Calendar" above the "Invitation From" section of the invite.
- Select the new "Spam Sucks" calendar you just created
- Go back to the "Calendars" button in Step 1
- Select the "i" next to the "Spam Sucks" calendar
- Select "Delete Calendar" at the bottom of page
- Confirm that you want to delete the calendar by selecting "Delete Calendar"
Now pat yourself on the back because killing spam is hard work! Hopefully Apple will get on this and fix this loophole that spammers have started to take advantage of, because 10 steps to get rid of calendar spam is 10 steps too many.