The Federal Trade Commission published a consumer alert on May 26, 2026, warning that graduation and summer party season had created a new opening for phishing scams — fake digital invitations designed to look like messages from Evite, Paperless Post, and Punchbowl that ask recipients to enter their email credentials or a special passcode before viewing event details. The FTC noted it was receiving a significant volume of reports. Evite itself had already flagged a notable rise in impersonation scams beginning in early 2026, warning users that the fakes copy its branding and formatting closely enough that even the company acknowledges they look remarkably similar to the real thing.
The scam works like this: an email or text arrives appearing to come from someone in your contacts. It lists that person as the host. It uses the platform’s logo, color scheme, and layout. The RSVP button either installs malware or redirects to a fake login page. One click hands scammers your email credentials, your contact list, and in some versions, access to your financial accounts. From there, the same fake invitation goes to everyone in your address book. The attack replicates itself through the social graph of the person it just compromised.
What makes this structurally different from most phishing attempts is the entry point. Most digital scams operate through fear — a fake bank alert, a fabricated legal threat, an urgent notice about a suspended account. Those messages trigger caution in most recipients because they arrive from unexpected directions with alarming content. The Evite scam operates through the opposite mechanism. Abhishek Karnik, head of threat research at McAfee, identified the distinction precisely: “You’re curious to know what they have to say, in this case, Evite.” The message triggers anticipation, not alarm. It arrives wearing the costume of social life.
That is not an accident. It is a design choice. FTC associate director Lois Greisman testified before the U.S. Congressional Joint Economic Committee on March 25, 2026, that reported fraud losses have increased year-over-year for six consecutive years and have risen nearly 430 percent since 2020. Consumers lost $15.9 billion to scams in 2025, up from $12.5 billion in 2024. The Identity Theft Resource Center flagged the Evite scam specifically as a departure from typical fear-based attacks — describing it as preying on the desire for social connection in a way that makes it harder to recognize as a threat. The scam is effective precisely because it doesn’t feel like one.
The broader pattern the Evite scam reveals is about what digital social infrastructure has made possible and what it has made vulnerable simultaneously. Platforms like Evite, Paperless Post, and Punchbowl exist because digital life made social coordination easier — invitations that reach everyone instantly, RSVPs tracked automatically, guest lists managed without paper or postage. That same infrastructure created a surface that scammers could replicate. The familiarity that makes a digital invitation feel trustworthy is the same familiarity that makes a fake one feel trustworthy. The design that serves social connection is the design that enables the attack.
The FTC alert noted that the scam has a self-replicating quality that distinguishes it from most phishing attempts: once a scammer accesses a compromised email account, they send the same fake invitation to every contact in the address book. The social graph becomes the distribution network. Every person the victim knows becomes a potential next victim — and the message that reaches them comes attached to a name they recognize and trust. The attack doesn’t just steal credentials. It converts the victim’s entire social network into infrastructure for the next wave.
The most reliable protection, per the FTC, is to verify unexpected invitations directly with the host before clicking anything — a step that requires treating social connection with the same skepticism typically reserved for financial alerts. That is the tradeoff the Evite scam is imposing on digital life. The platforms designed to make social connection easier are now requiring users to approach every unexpected invitation with suspicion. The cost of that suspicion — measured in hesitation, in second-guessing, in the friction introduced into ordinary social exchange — is distributed across everyone who uses them. The scammers absorb none of it.