Print
Birthday parties, weddings, graduations, and other celebrations are often organized online these days, making digital invitations a convenient way to connect with friends and family. Unfortunately, scammers are taking advantage of that convenience, too.
A phishing scam involving fake party invitations is making its rounds, and its goal is simple: trick people into handing over their email passwords, verification codes, or other sensitive information.
The Federal Trade Commission has warned consumers about unexpected “you’re invited” emails and text messages that appear to come from well-known invitation platforms such as Evite or Paperless Post. Some may even appear to come from someone you know, which can make the message feel much more believable.
How the Scam Works
You may receive an email or text that looks like a legitimate invitation. When you click the link to view the details or RSVP, you’re taken to a page that asks you to log in using your email address and password.
In another version of the scam, you may be asked to provide your phone number and then enter a verification code that was sent to you.
That should be a red flag.
A legitimate party invitation should not require you to enter the password to your email account just to see the event details. And if someone unexpectedly asks you to share a verification code, don’t provide it. That code could be exactly what a scammer needs to reset your password or gain access to an account.
Why Your Email Account Matters
We sometimes think of an email password as just another password, but access to your email can open the door to a lot more.
If a scammer gets into your email account, they may be able to find personal or financial information, reset passwords for other accounts, or even use your email to send the same scam to friends and family.
That’s also why using a different password for each account is so important. If the same password is used in several places, one compromised account can quickly put others at risk.
Take a Closer Look Before You Click
If an unexpected invitation lands in your inbox, don’t let curiosity get the better of you.
Start by checking the sender’s email address. Evite, for example, says its legitimate invitations come only from the evite.com domain or verified subdomains of evite.com, not from Gmail, Yahoo, Hotmail, or another personal email account.
If you’re unsure whether an invitation is real, reach out to the person who supposedly sent it using a phone number or contact method you already have. A quick text or call can save you from clicking on a fraudulent link.
Already Entered Your Information?
If you entered your password on a suspicious site, change it immediately.
If you use that same password on any other accounts, change those passwords as well. It’s also a good idea to turn on multifactor authentication wherever it’s available, which adds another layer of protection if your password is ever compromised.
And if you believe any financial information may have been exposed, contact your credit union or other financial institution right away.
Digital invitations are a convenient way to bring people together, but an unexpected invite is still worth a second look. Taking a few extra moments to check the sender, question unusual requests, and confirm the invitation with the host can help make sure the only surprise is the celebration itself.