Staying Safe from E-RSVP Scams

Recently, there have been many phishing reports of people receiving fake party invitations from three major RSVP software companies: Evite, Paperless Post, and Punchbowl. The emails look completely harmless, with cards attached inviting you to your neighbor's barbeque or coworker's retirement celebration.

Fake invitations are being used for two main types of scams:

• The invitation may prompt you to download invitation details. But in reality, these files can contain malware and harmful viruses that should not be saved to your computer.
• The second and more common method will require you to log in to RSVP. Once you do, your information will be stored and used for future scams.

If you receive one of these messages, the best course of action is to contact the host to confirm that the invitation is legitimate. Not only will this protect you from falling for the scam, but the "host" may not know their information has been compromised. Contacting them could keep everyone protected online.

If contacting the host isn't an option, look for these five red flags in the message:

1. The invitation requires a username and password to fully view it. Invitations sent from reputable RSVP software, like Evite or Paperless Post, are never login-protected.
2. The invitation must be downloaded to be viewed. If you can't immediately see the message, don't download it—this is likely a sign of a fake invitation.
3. The domain is off. Confirm that the domain is spelled correctly and is consistent with the one a particular company uses.
4. The invitation is from a personal email address. RSVP software utilizes specific email addresses to disperse invitations, so if the email comes directly from the host, it is likely a phishing attempt.
5. The invite feels random or vague. If you aren't close to the person inviting you, or if there are many details missing from the invitation, this may be a sign that the invite is fraudulent.

Phishing scams can happen to anyone, and there's no reason to be embarrassed if you accidentally believed a fake invitation was the real thing. Just immediately change your email password to something long and strong, and report the scam.

Individual RSVP software companies have also developed support measures to protect their clients from these scams. For more information, check out the user guides from Evite, Paperless Post, and Punchbowl.

Written by Sylvie Slotkin, Common Sense Media Advocacy Intern.