Introduction
You received a party invitation in your email inbox. Curious, you opened it to check the event details. The email took you to a link where you entered your email and password to log in to view the invite. And that's how, unknowingly, you fell victim to a phishing scam.
Evite email scams are on the rise. Scammers are impersonating legitimate invitation-sending sites like Evite, PunchBowl and PaperlessPost to send fake invites.
In this guide, we'll break down what the Evite phishing scam is, why it's easy to fall for and how you can spot a fake Evite scam from a real one.
What Is the Fake Evite Scam?
The Evite email scam is a phishing scam where scammers impersonate Evite, a legitimate site for sending party invitations.
When we receive an email, we rarely check the email address to confirm the sender. This is the mistake scammers exploit. The Evite scam email looks almost identical to an actual email you would receive from Evite itself, so it's easy to fall for.
You open the email to view the invite, but it takes you to a login page where you have to enter your email address and password. If you do so, your account gets hacked.
What Happens When You Click
When you click the RSVP button in a fake Evite email, it takes you to a fake login page. If you enter your email and password, the scammer can steal your credentials.
Once they get hold of your account, they can change the password, get access to other platforms connected to that account or use your account to send Evite phishing emails to your contacts.
What if you simply clicked the link?
If you only clicked the link without entering your credentials, you might still get hacked. Clicking the link can download malware on your device or steal your browser cookies, with which the hackers can indirectly steal your login credentials.
How to Identify a Fake Evite Email
To know if an Evite email you received is real or not, make sure to check the following:
-
Check the Sender Email Address
Always check that the sender's email address ends in@evite.com. Scammers use lookalike domains to trick you. And even if the email appears to come from a legitimate contact, it could still be fake. Scammers sometimes hijack real email accounts to send phishing emails to that person's contacts. -
Login Prompts
A real Evite email won't prompt you to log in to view the invitation or RSVP. An Evite email that requires you to log in to do so is a phishing email trying to steal your login credentials. -
Spot Poor Grammar, Typos or Generic Greetings
Generic greetings such as "Dear friend" are usually a sign of scam emails. Another giveaway of scam emails is typos and poor grammar. Official communication is almost always proofread and rarely includes such mistakes. -
Verify With the Sender Directly
With the Evite phishing scam on the rise, it doesn't hurt to be extra careful. It's always best to text or call the person to confirm if they actually sent the invitation. Confirming the invitation's authenticity can help prevent your account credentials from being stolen. -
Hover Over Links Before Clicking
On desktop, hover over the RSVP button to see the real destination URL. If it doesn't go to evite.com, don't click. It's a phishing link.
On mobile, press and hold the link to preview the URL before opening it.
- Watch for Attachments
A real Evite invitation email will never contain any PDF or ZIP files. If you see any attachment in the email, DO NOT click on it. Scammers use attachments to install malware on your device.
What to Do If You Already Clicked?
Accidentally clicked a link in a fake Evite email? Don't panic. But don't wait either. Take these steps immediately to minimize the damage.
- Clear Your Browser Cookies & Cache
Clicking the link in a phishing email can let attackers steal your active login session through cookies stored in your browser without ever needing your password. Clear your cookies and cache to invalidate any stolen session data.
Press Ctrl + Shift + Delete (Windows) or Cmd + Shift + Delete (Mac), set the time range to All time, check Cookies and other site data and Cached images and files, then click Clear data.
-
Run a Full Antivirus Scan
Clicking the link in a phishing email can download malware on your device even if you didn't enter your credentials on a login page. Run a full antivirus scan (not a quick one) to make sure it's found and removed. Use a trusted antivirus software such as Avast or McAfee. -
Change Your Passwords
Immediately change the password of your Gmail/Google account. Then do the same for any platforms where you used the same password or signed in with Google, such as social media, shopping sites, or banking apps. -
Enable Two-Factor Authentication
Enable two-factor authentication on your Gmail account, banking apps and any other important accounts. It helps secure your account against unauthorized logins even if the scammer gets hold of your password.
How BlockSender Helps Protect You
If you want an easy way to make sure a scam sender never reaches your inbox again, one option is Block Sender, a Gmail add-on that lets you block them in a couple of clicks.
If you receive a fake Evite email, just block that sender. And if the email came from a hacked account rather than a scammer's own, it's still worth blocking that address until the real owner regains control - that way you won't accidentally fall for another scam sent from it later.
To use it:
- Install Block Sender for Gmail. The installation won’t take long. Open Gmail when it is done.
- After signing up for a Block Sender account and linking your Gmail account to Block Sender, open the fake Evite email and click the "Block" button on the messages toolbar.
- Select the "Emails from this sender" option.
Conclusion
Fake Evite scams are easy to fall for but just as easy to spot once you know the signs. Check the sender address, hover over links, and never log in through an email prompt.
If you've already clicked, act fast - clear your cookies, run a scan, and change your passwords.
