Scammers hijack accounts and send fake invites that look real, tricking you into logging in and handing over your email and password.
Once you click, they can take over your account, access your contacts, and spread the scam to your friends — often before you realize it.
Protect yourself by not clicking right away, verifying invites directly with the sender, and never entering login info through email links.
A recent column from The Washington Post highlights a fast-growing scam that feels harmless at first, but can quickly spiral into identity theft.
It often starts with a simple party initiation sent to your email or Facebook account.
Maybe it says, “You’re invited!” or “Shhh… it’s a surprise!” and it usually comes from someone you know or a name you recognize. But behind the scenes, it’s part of a larger scheme where scammers hijack accounts, impersonate people, and take advantage of people’s trust.
By the time victims realize what’s happening, their email or social media accounts may already be compromised, and their friends could be next.
How the scam actually works
A hacker first gains access to someone’s email or social account.
Then they send out invitations or messages that look legitimate. They’re often done through platforms that mimic real services like Paperless Post or Punchbowl. The invite design will typically look identical to real invite platforms, making the scam tricky to identify.
Once you click the invitation:
- You’re taken to a fake login page.
- You’re asked to enter your email and password.
- Your credentials are captured instantly.
From there, scammers can:
- Take over your account.
- Access your contacts.
- Send more fake invites from your account.
- Attempt identity theft or financial fraud.
The worrisome part is that the damage can spread quickly. Once one account is compromised, it can easily trigger dozens more.
Red flags you shouldn’t ignore
Even convincing scams leave clues if you know what to look for:
- The invite comes from a personal email address, not the actual platform.
- You’re asked to log-in just to view an invitation.
- The message is vague (no date, time, or important details).
- A friend sends something that feels out of character for them.
A good rule-of thumb to remember is if anything feels slightly off, assume it is until proven otherwise.
How to protect yourself (and your contacts)
This is one of those scams where a few simple habits can make a big difference.
- Don’t click immediately: Even if it looks real, pause for a moment. Most scams rely on quick reactions.
- Verify outside the message: Text or call the person who “sent” the invite. A quick check can stop the scam cold.
- Never log in through a link: If you need to check an invite, go directly to the official website instead of clicking on the email link.
- Turn on two-factor authentication: This adds a second layer of protection — even if your password is stolen.
- Watch for duplicate accounts: If you get a new friend request from someone you already know, it could be a cloned profile.
- Act fast if something feels off: If you clicked, or entered information, you should do the following:
- Change your password immediately.
- Enable 2-factor authentication if available.
- Alert your contacts.