Have you received an invitation from Punchbowl or Paperless Post, and it’s asking you to sign in so you can see the invite? Don’t do it! It may look like it’s from a friend, but it’s really a phishing scam to steal your login info.

The Invitation Phishing Scam

I’ve gotten three of these this past week, so this scam is pretty active right now. At first glance, the emails look legitimate. They use familiar branding and claim that someone has sent me an invitation. I recognized the friend’s name in the first invitation, so I suspect she fell for it, and they are using her e-mail to fool other people.

Since Punchbowl and Paperless Post are both popular online invitation services, it’s easy to see why someone might click without thinking twice. I know I did the first time!

Although each email I received looked slightly different, they all led to the same fake login page.

The email encourages you to click a button to view your invitation. Instead of showing you the invitation, however, you’re presented with a page asking you to sign in using one of several popular account providers. Depending on the version of the scam, you may see options to log in with Google, Microsoft, Yahoo, AOL, or other email and social media services.

The scammers hope you’ll assume this is a normal security step. In reality, they’re simply trying to capture your username and password.

Spotting the Scam

One of the easiest ways to spot this scam is by checking the website address before entering any information.

The email may claim to be from Punchbowl or Paperless Post, but when the page opens, the URL often belongs to a completely unrelated website. The scammers copy the appearance of the real invitation services, hoping you won’t notice that you’re on a fake domain.

If you look carefully at the address bar, you’ll see that it isn’t an official Punchbowl or PaperlessPost page.

Another warning sign is that legitimate invitations generally do not require you to log into your email account just to view them. If you’re suddenly being asked for your email password, that’s a major red flag.

And that’s where I paused the first time I got one of these. It just seemed wrong.

What Happens If You Sign In?

I didn’t go any further than the login page, so I can’t say exactly what happens next. However, the purpose of these phishing pages is straightforward: they collect your login credentials.

If you enter your username and password, that information can be sent directly to the scammers. Once they have access to your email account, they may attempt to:

• Access sensitive personal information stored in your inbox.
• Reset passwords for other online accounts.
• Send phishing emails to your contacts.
• Use your account for additional scams. (like what I think happened with my friend)

Because many people reuse passwords across multiple websites, a single stolen password can sometimes give criminals access to several different accounts.

How to Protect Yourself

If you receive an unexpected invitation, don’t click the link right away. Instead:

• Check who sent the email.
• Hover over links to see where they actually lead.
• Look carefully at the website address before entering any information.
• Never enter your email password on a website unless you’re certain it’s legitimate.
• If you’re unsure whether someone actually sent you an invitation, contact them directly and ask.

Scams Are Always Evolving

Phishing scams continue to evolve, and scammers are getting better at copying the appearance of trusted brands. The good news is that a few seconds of checking the sender and website address can prevent your accounts from being compromised.

If you receive one of these fake Punchbowl or Paperless Post invitations, simply delete it. And if you accidentally entered your login information, change your password immediately and enable two-factor authentication if you haven’t already.

Have you received one of these fake invitation emails? Let me know in the comments—I’d be interested to hear if yours looked like the ones I received.