Fake party invite scam: Can you trust a friend's reply? - Fox News

John in Westlake, Ohio, received what appeared to be a fraudulent Evite for a 'Dinner Gathering & Celebration.' After suspecting a phishing attempt, he emailed his friend to verify the invitation.

The reply he received, seemingly from his friend, confirmed the event was legitimate. This reassurance led John to believe the invitation was safe, but he later confirmed the emails were part of a scam.

The experience highlights a new tactic where scammers use a compromised email account to validate fraudulent invitations, making them appear more credible to recipients.

How the scam works

The scam begins with criminals sending fraudulent invitations that mimic legitimate services like Evite or Paperless Post. These messages often appear to come from a trusted contact.

If the recipient is suspicious, they may email the sender to ask if the invitation is real. If the criminal controls the sender's email account, they can intercept this question and send a reassuring reply.

This reply can be generated manually or through an automated Gmail response, creating the illusion that the invitation is genuine. The recipient, seeing a familiar email address confirm the event, may feel safe clicking the link.

We're not currently seeing a rise in phishing scams, however, staying aware is always important, which is why we're constantly monitoring and providing tools to help users spot the fakes.

Recognizing the signs

Evite advises that a real invitation will contain highly specific details, such as parking instructions, dress codes, and event themes. A generic invitation that only says 'You're invited' with a link should be treated with caution.

However, scammers can also create convincing invitations with specific details. This is why relying solely on the content of the invitation is not enough to ensure its legitimacy.

The Federal Trade Commission has also warned about fraudulent invitations that ask users to enter their email password or share a verification code before revealing event details. These requests are a major red flag.

Protecting yourself

To protect against this scam, the safest verification method is to contact the sender through a phone number or another communication channel you already trust.

If you must use email, be wary of unusual replies. Pay attention to writing styles that don't match the person or answers that don't fit the conversation. Unexpected requests to click another link should also raise suspicion.

It is also important to secure your own email account. Review your Gmail settings for unfamiliar filters, forwarding rules, or automatic vacation responses that could indicate unauthorized access.