Fake Evite Scam Highlights Risks of Compromised Email Accounts

A recent phishing scam has demonstrated how attackers can exploit compromised email accounts to trick recipients, even when they attempt to verify the legitimacy of a suspicious message. The incident involved a fake Evite invitation that, when questioned by the recipient, received a confirming reply from the sender's apparently hacked email account.

The Suspicious Invitation and Unsettling Reply

A man, identified only as John from Westlake, Ohio, received an Evite that he suspected was fraudulent. Instead of clicking the invitation link, he chose to email his friend directly to confirm its authenticity. To his surprise, he received a reply that appeared to confirm the invitation was legitimate. However, the message contained grammatical errors and an unusual tone, which made John even more suspicious.

"It appears that the scammers either set up an auto-response on the Gmail account or manually responded to my email. The punctuation was wrong, so I didn't consider the response legitimate," John stated. He later confirmed with his friend that the invitation was indeed part of a scam. The fake invitation, branded to look like a legitimate Evite, advertised a "Dinner Gathering & Celebration" and featured a "View Invitation" button.

This scenario highlights a potential vulnerability in how individuals verify suspicious communications, especially when the sender's email account might be compromised. The Federal Trade Commission previously warned about similar fraudulent invitations imitating popular services like Evite and Paperless Post, which can prompt users to enter their email passwords or verification codes on fake websites.

How Compromised Accounts Facilitate Scams

When scammers gain access to an email account, they can send out fraudulent messages that appear to originate from a trusted source. If a recipient attempts to verify the message by replying to the compromised account, the scammer, or an automated response set up by them, can intercept the query and provide a false sense of security. This tactic can make a fraudulent invitation seem legitimate, leading unsuspecting individuals to click malicious links or download harmful software.

While it remains unclear whether the reply John received was automated or manually sent by the scammer, the incident underscores that a seemingly reassuring response from a familiar email address does not guarantee safety. Gmail does allow users to set up auto-responses and filters, which could be misused by unauthorized account access.

Evite's Advice on Spotting Scams

Evite acknowledged the potential for such scams and offered guidance on how to distinguish real invitations from fake ones. According to Evite, legitimate invitations today often include specific details such as parking instructions and dress codes, moving beyond generic