Con Watch: Watch Out for Evite Phishing Emails

Steve Weisman is a lawyer, college professor, author, and one of the country’s leading experts in cybersecurity, identity theft, and scams. See Steve’s other Con Watch articles.

Evite is a popular online invitation platform that allows users to create, send, and manage digital invitations for events such as parties, weddings, meetings, and other gatherings. It is widely used because it simplifies the process of inviting guests and tracking RSVPs. Evite is trusted and familiar to many users, making it an effective tool for scammers.

Recently, Evite and other online invitation services have seen a significant increase in scams in which crooks send phony invitations. Because people often receive Evite invitations from friends or colleagues, they may not even question whether it is legitimate and click links without suspicion. If you click on links in a scam Evite invitation you may end up downloading dangerous keystroke logging malware that can steal sensitive personal data such as passwords or account information that will result in scammers being able to access your bank accounts, credit card accounts, or investment accounts and reset your passwords.

In other instances, the fake invitation will require you to provide your email address and password, which can give access to your email account to the scammer. They can then leverage that information to not only gain access to your email account, but to other accounts that you may have where you have used the same password.

How to Protect Yourself

Always use dual factor authentication on all your accounts so that even if your password is compromised, your account will remain secure. Also use a unique password for each of your online accounts.

One way to determine if an invitation you receive is legitimate is to check the email address of the sender. I received an Evite invitation recently, and the sender’s email address was that of a real friend of mine; while this may make the Evite invitation appear authentic, it actually is an indication that it’s a scam — real Evite invitations only come from the domain Evite.com or verified subdomains of Evite.com. Real Evite invitations will never come from Gmail, Yahoo, or Hotmail, and they never come from the email address of the person using Evite to send invitations. In cases where the Evite appears to come from one of your friends, the highest likelihood is that your friend’s email account was hacked and used to send out the phony Evites.

Also make sure to install security software and keep it updated. While this may protect you from some malware, no security software can protect you from everything; the scammers are always one step ahead.

The best option whenever you receive an electronic invitation is to contact directly the person or company that appears to be sponsoring the event to determine whether it is legitimate or not. It may seem paranoid, but even paranoids have enemies.