This article originally appeared in TidBITS on 2016-11-29 at 9:23 a.m.
The permanent URL for this article is: http://tidbits.com/article/16923
Include images: Off

How to Stop iCloud Calendar Spam

by Andy Affleck

A new and pernicious kind of spam has crawled from the ooze to take advantage of an iCloud feature. By default, if someone sends you an event invitation, iCloud automatically inserts it into your calendar and prompts you to accept or decline the invitation within the Calendar app on your Mac or iOS device. This is a nice feature when you’re receiving actual invitations to meetings or outings with friends.

Unfortunately, spammers have discovered that they can use it to send you ads in the form of invitations. Right before Thanksgiving, I received a pair of ads that were all-day events advertising a sale on sunglasses. These events had alerts set, and they appeared on all of my devices (home Mac, work Mac, iPhone, iPad, and Apple Watch).

[image link] [1]

Needless to say, I wasn’t happy about this and went to remove these events from my calendar. Unfortunately, if you attempt to remove an event, either by deleting it or by selecting it and choosing Edit > Cut, Calendar informs you that removing the event will cause a notification to be sent to the event organizer.

[image link] [2]

That seems like a bad idea. The general assumption is that you never want to respond to a spammer because doing so could lead to receiving even more spam. I don’t know if this is actually true; it seems unlikely that modern spammers would bother to collect and use such data. Regardless, it feels wrong to acknowledge such spam in any way.

In order to remove the event without sending a notification back to the spammer, you need to follow a few steps that you might not think of on your own:

  1. In Calendar on your Mac, create a new calendar by choosing File > New Calendar > On My Mac. You don’t even have to name it — “Untitled” works just fine.

  2. Drag the spam events to the new Untitled calendar in Calendar’s sidebar.

  3. Control-click the Untitled calendar and choose Delete. Calendar asks if you want to delete it or merge it with another calendar. Click Delete.

  4. [image link] [3]

Obviously, this method for dealing with calendar spam is annoying, and not the sort of thing you would want to do regularly. Luckily, you can keep such spam off your calendar by disabling the feature that adds event invitations to your calendar automatically. Once you do this, you’ll receive event invitations via email, and you can accept or reject them from there.

To change the invitation notification setting, follow these steps on the iCloud Web site [4]:

  1. Log in to your account and click Calendar.

  2. Click the gear in the bottom left and choose Preferences.

  3. Click the Advanced tab, and under Invitations at the bottom, select the Email to yourEmailAddress radio button.

  4. [image link] [5]

On the plus side, making this change may mean that your email spam filter will catch future spammy event invitations, so you may never see them again. However, if you also get legitimate event invitations, your spam filter might erroneously identify them as spam too, so pay attention when you might be receiving a meeting invitation.

It’s up to Apple to solve this problem for real. The first step would be to allow the user to delete a calendar invitation without notifying the sender. In the real world, you’re allowed to ignore an invitation, and the virtual world should honor that as well. Slightly more complex would be a setting to receive event invitations only from people in your contacts list. Between these two options, most users should be able to eliminate calendar spam or at least make it easily deleted.

After initial publication of this article, Apple made a statement [6] to iMore:

We are sorry that some of our users are receiving spam calendar invitations. We are actively working to address this issue by identifying and blocking suspicious senders and spam in the invites being sent.

We can hope Apple puts an end to this problem, but if not, you can use the techniques in this article to protect yourself from calendar spam.

[1]: http://tidbits.com/resources/2016-11/Calendar-spam.jpg
[2]: http://tidbits.com/resources/2016-11/Delete-Calendar-event.png
[3]: http://tidbits.com/resources/2016-11/Stealthily-delete-Calendar-event.png
[4]: https://www.icloud.com/
[5]: http://tidbits.com/resources/2016-11/iCloud-Calendar-settings.png
[6]: https://twitter.com/reneritchie/status/804081476904042496