Q: I’ve been getting strange invitation emails lately; how do I know if they’re real?
A: With graduation parties, weddings and summer get-togethers filling up the calendar, it’s perfectly normal to be receiving event invitations by email and text especially right now. In fact, the Federal Trade Commission just issued a warning that scammers have noticed the same thing — and they’re using the season to their advantage.
Related stories
The scam works like this: you receive what looks like a normal invitation from a familiar platform like Evite or Paperless Post. The message may even list someone you know as the host. When you click to RSVP, the page asks you to sign in with your Google account, Microsoft account or email and password before you can see the details.
The moment you enter those credentials, scammers capture them and use them to access your email — and potentially every other account tied to that login, or to lock you out completely.
The thing to understand is that real invitation platforms don’t require any kind of password or credentials to open an invitation. That’s not how they work. If a party invitation is asking for either first, it isn’t a real party invitation.
How to spot a fake
There are several reliable warning signs worth knowing before you click anything. Start with the sender’s email address; legitimate platforms like Evite and Paperless Post send from their own verified domains, not random Gmail or Yahoo addresses.
Look closely at any logos or images in the message, since fake invitations often have images that won’t load, logos that appear the wrong size, or text that doesn’t align properly.
Before clicking any link, hover over it first to see the actual destination URL. If it doesn’t match the platform it’s claiming to be from, don’t click it.
On a mobile device, you can press and hold a link to preview the URL before opening it.
It’s also worth noting that the FTC has tracked over 80 fake invitation domains created since December 2025 alone, many of them designed to mimic the exact login screens of Google and Microsoft. The goal is to make the page look familiar enough that you enter your credentials without thinking twice.
What to do if you already clicked
If you entered your credentials on a suspicious page, the most important thing is to act quickly. Change the password on the account you signed in with, then check every service where you use that same login, particularly anything connected through sign in with Google or Microsoft.
Enable two-factor authentication if you haven’t already, and you can report the incident at ReportFraud.ftc.gov.
Keep your security software subscription up to date as well, since updated software can flag known phishing domains before you ever reach the fake login page.
Summer is a busy season for both parties and scammers. Knowing what a legitimate invitation does and doesn’t ask for is the simplest way to tell the difference between the two.
Get breaking news and daily headlines delivered to your email inbox by signing up here.
© 2026 WTOP. All Rights Reserved. This website is not intended for users located within the European Economic Area.
