When John Lantigua, a retired journalist in Miami Beach, checked his email on a recent morning, he was happy to see the invitation.
“It was like, ‘Come share the evening with me. Click here for details,'” Mr. Lantigua said.
It looked like an invitation from the Paperless Post from someone he used to work with at The Palm Beach Post, a man who had left Florida for Mississippi and liked to host dinner parties when he was back in town.
Mr. Lantigua, 78, clicked on the link. It didn’t open.
He clicked a second time. Still nothing.
He didn’t realize what was going on until a mutual friend who got the same email told him it wasn’t an invitation at all. It was a scam.
Phishing scams have long tried to scare people into clicking on links in emails that claimed their bank accounts had been hacked, or that they owed thousands of dollars in fines, or that their pornography viewing habits were being monitored.
The invitation scam is a little more subtle: it feeds off the all-too-human desire to be part of social gatherings.
Fake invitations mimic emails from Paperless Post, Evite and Punchbowl. What looks like a friendly overture from someone you know is actually a digital Trojan that gives scammers access to your personal information.
“I thought it was diabolical that they chose someone who had previously sent me a legitimate invitation,” Mr. Lantigua said. “He’s my friend. If he comes to town, I want to see him.”
Rachel Tobac, CEO SocialProof securitycybersecurity firm, said it noticed the scam last holiday season.
“Phishing emails are nothing new,” Ms. Tobac said, “but every six months we get a new bait that hijacks our amygdala in new ways. People have such a desire to meet that the bait is interesting to people. They want to go to the party.”
Phishing scams involve “two distinct paths,” Ms. Tobac added. In one, a link is delivered to the recipient that turns out to be dead, or so it appears. The click activates the malware, which runs silently as it collects passwords and other bits of personal information. This most likely happened when Mr. Lantigua clicked on the link with the replacement invitation.
Another scam offers a working link. Potential victims who click on it are asked to enter a password. Those who take this next step are a boon to hackers.
“They have complete control over your email and subsequently your entire digital life,” Ms Tobac said. “They can reset your dog’s Instagram account password. They can take over your bank account. Change your health insurance.”
Digital invitation platforms are trying to fight fraud by publishing conductor on how to find out fake invitations. Paperless Post also set up an email account — phishing@paperlesspost.com — for users to send messages for verification. The company sends suspicious links to Anti-Phishing Task Forcea non-profit organization that maintains a database monitored by cyber security firms. Tagged links are invalid.
Scammers’ new strategy of exploiting the desire to connect is infuriating, said Alexa Hirschfeld, founder of Paperless Post. “Life can be isolating,” Ms. Hirschfeld said. “When it looks like you’re getting an invitation from someone you know, your first instinct is excitement, not skepticism.”
Olivia Pollock, Evite’s vice president of branding, said the fake invitations were usually generic, promising a birthday party or a celebration of life. Most invitations these days tend to have a specific focus – for example, a mahjong meeting or a book club lecture. “The devil is in the details,” Ms Pollock said.
Because scammers don’t know how close you are to people in your contact list, fake invitations can also seem random. “They could be from your business school roommate who you haven’t spoken to in 10 years,” Ms. Hirschfeld said.
Alyssa Williamson, who works in public relations in New York, was walking out of a yoga class recently when she checked her phone and saw an invitation from a college classmate.
“I assumed it was an alumni event,” Ms Williamson, 30, said. “I clicked on it and it was like, ‘Enter your email.’ I didn’t even think about it.”
Later that day, she received messages from friends asking about invitations to the party she he just had sent out. Her response: What party?
“The thing is, I do a lot of events,” she said. “Some knew it was fake. Others said, ‘What is it? I can’t open it’.”
Andrew Smith, a graduate finance student who lives in Manhattan, received what appeared to be an invitation to Punchbowl for a “celebration of memories.” It appeared to be from a woman he dated in college. He got it while drinking at a bar on Friday night — “a pretty sneaky bit of timing,” he said.
“The choice of sender was super smart,” Mr Smith, 29, commented. “He was someone who would probably get a reaction from me.
Mr. Smith took the phrase “celebration of memories” and filled in the blanks. He imagined that someone in his ex-girlfriend’s immediate family had died. Maybe she wanted to reconnect at this difficult time.
Something saved him when he clicked on the link and tried to tap out his personal information – his inability to remember the password to his email account. The next day, he contacted his ex, who confirmed that the invitation was fake.
“It didn’t set off any alarm bells,” Mr Smith said. “I went right for the push-up. I was completely animal brain.”
The new scam comes with an unfortunate side effect, the suspicion of invitations. It is enough to make a person antisocial.
“Don’t invite me,” said Mr. Lantigua, a former journalist, only half joking. “I’m not coming.”
