Recipients checking with the supposed host are finding the invitations were never sent, in a wave of scams impersonating Evite and Paperless Post.

 

What happened

Phishing messages impersonating digital invitation services are reaching people through the names of real contacts taken from compromised address books and public social media connections, Wired reported on September 25, 2026. Subject lines advertise a private dinner party or an exclusive weekend gathering. Clicking the RSVP link opens a fraudulent page asking for an email username and password to see the event details. Another version asks for a phone number and a confirmation code, which lets the attacker get past two-factor authentication on the recipient's account.

 

Going deeper

New York journalist Eric Umansky found his inbox filling with messages from former colleagues and acquaintances while he was at a family event in April. Each had received a Paperless Post invitation appearing to come from him, for a dinner party on May 2 at 7:00 p.m. He had sent nothing. After checking his two-factor authentication settings and posting warnings across his social accounts telling people not to attend, he worked through the replies. Dozens of recipients had engaged with the message to varying extents.

 

What was said

The Federal Trade Commission issued a consumer alert in May 2026 warning about an increase in these messages, Wired noted. Security specialists quoted in the report describe phishing as among the most serious risks facing individuals and organizations, and say the use of artificial intelligence has made these messages harder to identify by producing well-written, contextually appropriate text at scale. Their advice is unchanged: do not click links in unexpected emails regardless of who appears to have sent them, and go to the platform directly or contact the sender through a different channel.

 

In the know

Research explains why the recipients responded the way they did. A 2024 study in the journal Communications Psychology found that adults frequently avoid contacting old friends because they expect the conversation to be awkward or assume the other person is too busy, according to Wired's account of the findings. The study also recorded people withdrawing socially while navigating life changes such as becoming a parent or relocating. Asking whether an invitation is real supplies a reason to make contact that carries none of that hesitation, which is why the verification step so often turned into a conversation.

 

The big picture

An attacker who obtains an email password gains the account and the address book inside it, which supplies the next set of targets with a sender they recognize, as the FTC describes in its alert on these messages, warning that a successful takeover lets the attacker send the same scam on to the victim's contacts. Where the password has been reused on a work account, the takeover crosses over, which is why NIST requires identity providers to check chosen passwords against lists of previously compromised credentials before accepting them, in its digital identity guidelines. Healthcare organizations cannot govern what staff does with personal accounts, leaving two controls on the work side: authentication that fails on a lookalike page regardless of what the user types, and alerting when a mailbox begins sending in volume to its own contacts. A clinical mailbox holds patients, referring physicians, and suppliers, so propagation from a staff account reaches further than in most sectors.

 

FAQs

Why would an invitation ask for an email password?

It would not. Invitation platforms send a link opening the event page directly, with no login to the recipient's email provider involved. Any page requesting email credentials to display an invitation is collecting them for another purpose.

 

What happens when someone shares a confirmation code?

Those codes are generated during a login or password reset on the real account. Passing one to an attacker completes the action they started, which is how the technique gets past two-factor authentication without breaking it.

 

How do attackers obtain the contact names?

From address books in accounts they have already compromised, and from publicly visible connections on social platforms. Both produce names the recipient recognizes, which is the element that makes the message work.

 

What should someone do after entering credentials on a fake page?

Change the password on the real service immediately, sign out all sessions, check for forwarding rules or recovery addresses added by someone else, and tell contacts that messages may have gone out in their name.

 

Does this differ from phishing directed at organizations?

The mechanism is the same and the pretext is not. Workplace phishing borrows authority or urgency, while this borrows a social relationship, and the account it takes is usually personal rather than corporate.