Resources to improve your home plus a chance to win $10K

Content starts here

Criminals Pose as Friends to Get You to Click on Fake Party Invitations

Bogus invites appear to come through popular email invitation services and aim to steal your money, contacts or personal information

Matt Alderton,

AARP

En español

Published July 31, 2026

A computer mouse icon clicks on a physical party invitation. A pop up opens, asking the user to enter their email or password.

AARP (Getty Images)

Key takeaways

Scammers are sending fake party invitations that mimic services like Evite, Paperless Post and Punchbowl to steal login credentials.
Invitation scams exploit curiosity and fear of missing out, making people more likely to click suspicious links.
Checking sender addresses, avoiding unexpected sign-ins and using multifactor authentication can help reduce risk.

Everyone likes to feel included, especially when an invitation lands in their inbox with a clickable envelope. But before you open it to check out the details, pause: That virtual invite may not be what it seems.

Authorities are warning the public about an increase in reports of invitation scams, or “bogus party invitations,” as the Better Business Bureau (BBB) of Chicago and Northern Illinois put it in a recent alert about this new form of phishing. The Federal Trade Commission has also issued a consumer alert about this scam.

More Ways to Benefit

View All

Related Benefit 1
Related Benefit 2
Related Benefit 3
Related Benefit 4
Related Benefit 5

Sent by email or text message, fake invites often impersonate real invitations delivered via legitimate online invitation platforms like Evite, Paperless Post and Punchbowl, says Steve Bernas, the Chicago and Northern Illinois BBB’s president and CEO. The messages appear to come from friends, family members, colleagues and others whom the recipient knows personally, “and that’s why these scams work,” he says. “If you receive an invitation to a party from your friend Sue, you probably won’t think it’s a scam because you know Sue.”

How invitation scams work

In a typical phishing scam, criminals impersonate a trusted person, company or government agency with hopes of eliciting personal information that they can use to steal your money or identity.

Invitation scams are a new spin on the same recipe, says Lenny Gusel, head of fraud solutions at Feedzai in North America, which uses artificial intelligence to help banks and other financial institutions detect and prevent fraud.

“Criminals send invitations from an email domain that looks similar to an Evite or Paperless Post, and in the exact same format,” which is easy to do with AI tools, Gusel explains. “If you click on it, it asks you to log in to your Evite or Paperless Post account.”

Although there’s no legitimate site to log in to, scammers can capture your username — typically your email address — and password. With that information, they can access not only your Evite or Paperless Post account but also any other account that uses the same username and password, such as your email account.

Most Popular

“Oftentimes, you’ve uploaded all your contacts to your Evite account, so the scammers can immediately go and send similar fake invites to your entire contact list,” Gusel says. “And if they can then use the same password to access your email account, they can wreak all kinds of havoc. Many financial institutions, for example, will send a one-time passcode to your email address that you can use to access your bank account. So, your email address is a very effective way for scammers to start taking over many aspects of your life — financial and otherwise — that they can then monetize.”

In some cases, Bernas notes, clicking on a fake invitation might also enable scammers to infect your phone, tablet or computer with malware, including viruses that give scammers access to your camera and keystrokes or ransomware that locks you out of your device or your files until you pay a ransom.

Invitations are alluring

What makes invitation scams so insidious — and so effective — is that they exploit people’s desire for connection.

“It’s preying on our psychology, because we’re social beings and we want to be invited to things,” Gusel says. “So, it’s only natural that we want to open an invitation when we receive one.”

Bernas agrees: “The FOMO effect takes over — fear of missing out … and even if you don’t want to go to the party, you want to know more information. You’ll say, ‘I haven’t seen Steve for three years; I wonder why he’s inviting me to a party.’ You can’t help but be curious.”

Online invitation companies respond

Legitimate online invitation companies say they’re aware of invitation scams and are working hard to help their users avoid them. Evite, Paperless Post and Sincere Corporation, Punchbowl’s parent company, made the following statements to AARP:

Evite: “As an industry, we’re seeing an uptick in phishing, which is why we’re constantly monitoring and providing tools to help users spot the fakes,” Evite writes. To help users identify fake invitations, Evite has published a blog post with tips.
Paperless Post: “Paperless Post is aware of phishing campaigns that impersonate online invitation platforms … and we are actively working to combat them. We take the privacy and security of our users very seriously. Paperless Post sends millions of legitimate emails a week and remains a trusted service with higher reply rates than ever. These scams are not the result of any breach of our systems.” Read its tips here.
Punchbowl: “We’ve received reports of phishing emails that imitate our brand and appear to be Punchbowl invitations,” Sincere Corporation Chief Brand Officer Ariel Faulkner-O’Brien writes. “It’s important to be clear that these emails are not sent through our platform and are not associated with our company in any way.” Punchbowl has published guidance on its website to help consumers identify legitimate invitations.

How to spot fake invitations

Thanks to AI, it’s becoming increasingly difficult to tell fake invitations apart from genuine ones. If you know what to look for, however, there are usually some telltale signs. The next time you receive an online invitation, taking the following steps can help you authenticate it:

Check the sender. Before you click an invitation, look at the sender’s email address to determine where it came from (you may have to hover your cursor over the sender’s address to see the whole thing), advises Mike Scheumack, chief marketing and innovation officer at identity theft protection company IDIQ. “E-invitation platforms always send invites from their own domain,” Scheumack says. “They don’t send invites from an obscure domain that doesn’t make sense.” Legitimate invitations from Evite, Punchbowl and Paperless Post will come from email addresses that end in evite.com, punchbowl.com and paperlesspost.com, respectively.
Check the invitation link. Even legit invites include a link that you can click to view the full invitation. Before you click it, look to see where it points, Bernas suggests. You can do this on a computer by hovering your cursor over the link; on a mobile device, press and hold the link for a few seconds until the URL appears in a small box. “If the link is going to a third-party site — some random website that you never heard of — don’t open it,” Bernas says. “That’s what we call ‘the tipoff to the ripoff.’ ”
Visit the website. Instead of clicking an invitation link, Gusel suggests going directly to the invitation platform’s website. “If you go to their legitimate website and log in, it’ll show you all of your legitimate invitations,” he says.
Contact the host. If you’re surprised to receive an invitation, Scheumack advises reaching out to the host to verify it. “If you’re receiving an invite … and you weren’t expecting it, give them a quick call or a text message to ask, ‘Are you sending out invites?’ ” he says.
Avoid sign-ins and downloads. A legitimate invitation “will never ask you to log in or download anything” just to view the invite or RSVP to the event, Paperless Post tells AARP.
Beware vague invitations. “The best way to tell the difference is that a scam is generic, but a real gathering today is highly specific,” Evite advises. “Real hosts are overcommunicating — sharing everything from parking instructions and dress codes to very specific themes like ‘strawberry’ or ‘western.’ That level of detail is what makes a modern invite harder to fake.”

What to do if you’ve clicked

If you’ve clicked on a fake invitation — and especially if you’ve entered login credentials on a fraudulent website — the first thing you should do is change your password on any sensitive accounts or websites, such as your email account, online banking platform and social media sites, suggests Gusel, who says you should also enable multifactor authentication on those accounts if you haven’t already done so.

Next, Gusel advises, check with your financial institutions to make sure scammers haven’t touched your bank accounts. If they have, your bank can help you lock your accounts and determine whether it’s possible to recover lost funds.

Finally, it’s important to report invitation scams to the appropriate parties:

Report online scams to the FBI’s Internet Crime Complaint Center at IC3.gov.
Report fake or suspicious invitations to the impersonated platform. You can report scams to Evite at support@evite.com, Paperless Post at phishing@paperlesspost.com and Punchbowl at help@punchbowl.com.
Call the free AARP Fraud Watch Network Helpline at 877-908-3360 to speak with trained specialists who can offer support and guidance.

The key takeaways were created with the assistance of generative AI. An AARP editor reviewed and refined the content for accuracy and clarity.

Matt Alderton is a contributing writer who specializes in health and wellness, travel and technology. His work has also appeared in USA Today, Forbes and The Washington Post.

AARP Membership

Join AARP for only $15 per year with automatic renewal. Get instant access to members-only products and hundreds of benefits, a free second membership, and a subscription to AARP The Magazine.

Join