Back to fall's regular schedule of cross-country races, football games, girls-night-out fun and more means, well, someone is bound to invite you somewhere. And odds are good that at least one invite could be from a con artist who is impersonating a friend.
How the scam works: You get an invitation by email or text, maybe it appears to be from Evite or Paperless Post. It might say something like: "You have been specially invited to an event. Don't miss out! Limited space available."
And you're going to be asked to log in with your email. If you click on any links or provide any passwords, though, the only party will be the one scammers will have with your information and, maybe even, your money.
Most invitations to activities, even kids' birthday
parties, come by email or text now. Yet, some experts warn that fake invitations tap into the shortcuts we take in everyday life to make it easy for scammers to steal passwords and hijack email accounts.
The invitation you're receiving may appear to be from someone you know when, unfortunately, it's really not.
"When was the last time any of us received an invitation in the mail?" said Amy Nofziger, senior director of victim support for the AARP Fraud Watch Network.
"Except maybe for a wedding."
How the party invite scam works
Logging in through the link provided to you when it is being sent by scammers essentially gives the criminals access to your log-in information, said Nofziger, who notes that the AARP Fraud Watch Network has seen an uptick in complaints about this type of scam.
"Most people use the same log-in for everything," Nofziger said.
"So what the criminals will do is take that username and password and they'll try your bank account, your Delta SkyMiles account, your hotel account, your email and see what they can have access to," she said.
Many times, victims can end up seeing one or more of their accounts being compromised.
Nofziger said the AARP Fraud Watch Network has heard complaints from consumers that their airline frequent flier miles are being stolen or their hotel points.
Unfortunately, she said, many people may not be as careful with passwords and user IDs for these accounts, as they might be with a bank account or 401(k). Many consumers might not have a very unique password or log-in for an Evite account, frequent flier accounts or another account connected with rewards points.
"The criminals are just taking that user name and password that they were able to ascertain from you logging into their fake invite and trying it on anything that has perceived value to them," Nofziger said.
In some cases, she said, rewards or points can be used to buy items that can later be resold by criminals.
When someone's email is compromised, Nofziger explained, the criminal has access to that victim's email and address book. The crime ring will take over the email account, pretending to be them and then perpetuate the fraud even further.
What Evite says about party invitation scams
I reached out to Evite, which acknowledged that the party invitation industry is indeed seeing an uptick in phishing.
"The best way to tell the difference is that a scam is generic, but a real gathering today is highly specific," according to a statement that Evite shared with the Detroit Free Press.
"Real hosts are over-communicating — sharing everything from parking instructions and dress codes to very specific themes like ‘Strawberry’ or ‘Western,' " Evite stated.
"A real Evite host today is telling you where to park and what to wear," according to the statement supplied to the Detroit Free Press.
The level of detail given in real invitations makes a modern invite harder to fake and "gives guests the confidence to say ‘yes’ without second-guessing," Evite stated.
Consumers who receive an invitation to a party or event, according to Evite, should be extra cautious if the email or text simply says "you're invited" and includes a link without any real details.
Other essential tips: Check the sender's email address. "Real Evite emails ONLY ever come from the domain evite.com and verified subdomains of evite.com," according to a blog with an alert that Evite has online.
"All these domains are authenticated with SPF, DKIM, and DMARC. If you use Gmail, you can verify this by clicking the three-dot menu in the email and selecting “Show original” — all three will show as PASS."
Evite warns that you should not click any links in a suspicious email. "If you already clicked a link, clear your browser’s cookies and cache, and run an anti-virus scan on your device," Evite suggests.
The FTC is warning about party invitation scams, too
The Federal Trade Commission issued an alert on party invite scams, as well.
According to the FTC alert, scammers are impersonating well-known invitation platforms like Evite or Paperless Post.
"Some messages list someone you know as the host and make you enter your email username and password to see event details," the FTC said.
"Some messages tell you to enter a phone number and share a special code to RSVP. That’s not how real invitations work. This is just a scammer trying to steal (or reset) your account information. If they get in, they might take over your email account and send the same scam to your contacts," according to the FTC alert.
It's one more reason to be extra cautious when you get an email out of the blue for an event or any other reason.
AARP's Nofziger shared her own experience with what seemed like a suspicious invite.
In May and June, she was invited to several graduation parties. One invitation did not look quite right. She called her friend directly, but in this case, her friend did send the invite. It never hurts, though, to ask.
What do you do if you think you were scammed? "If you think a scammer has your email account information," the FTC advises, "change your password to create a new, strong passphrase right away."
Consumers who fear that they've been scammed can go to IdentityTheft.gov for specific steps to take to protect themselves.
Call the AARP Fraud Watch Network Helpline at 877-908-3360 if you suspect a scam or you've lost money to a scam. Fraud specialists can help guide you on what steps to take next.
You also can report fraud complaints to your local FBI field office by calling 800-225-5324 or visiting www.fbi.gov to learn about common scams. See www.ic3.gov to file a complaint with the Internet Crime Complaint Center.
In metro Detroit, you can call the FBI at 313-965-2323 and ask for the duty agent.
Victims 60 or older who need assistance filing anIC3 complaint can contact the Department of Justice Elder Justice Hotline at 833-372-8311.
The FTC notes in its "party invite" alert that consumers can forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and texts to SPAM (7726). You can then report the phishing attempt to the FTC at ReportFraud.ftc.gov.
Contact personal finance columnist Susan Tompor: stompor@freepress.com. Follow her on X @tompor.
This article originally appeared on Detroit Free Press: You're invited to a scam. Crooks plan to party with your information
