Fake party invites are the latest phishing bait, Pennsylvania attorney general warns

Scammers are hijacking email accounts to send fake invitations that appear to come from friends, coworkers

The scam often uses links tied to digital invitation or social-planning platforms and may prompt users to log in with Google, Apple, Microsoft, or other accounts.

Pennsylvania officials are warning consumers about a growing phishing scam that disguises itself as an online party invitation or event RSVP.

According to the Pennsylvania Office of Attorney General, scammers are sending emails from compromised accounts belonging to friends, relatives, coworkers, or acquaintances. The messages often appear to invite recipients to a birthday party, conference, wedding, social gathering, or other event and include a link to “view” the invitation or RSVP.

But clicking the link can expose consumers to malware or credential theft, officials warned.

The scam typically escalates when the recipient is asked to log in using a Google, Apple, Microsoft, or similar account to access the invitation. Authorities stressed that legitimate invitation platforms generally do not require recipients to sign in simply to view an invite.

“Scammers are constantly evolving their tactics to appear more credible and trustworthy,” Attorney General Sunday said in a statement. “If you receive an unexpected invitation that requires you to log in or provide personal information, take a moment to verify it directly with the sender — that extra step can protect your personal data and prevent serious harm.”

How the scam works

Consumer protection officials say the scheme relies heavily on trust and familiarity. Because the emails appear to come from someone the recipient knows, users may be more likely to click links without carefully checking them.

Once a victim enters credentials into a fake login page, scammers can gain access to email accounts, contacts, stored passwords, financial information, and other sensitive data. In some cases, malware may also be installed on the victim’s device.

Officials warned that compromised email accounts are often then used to target additional victims, allowing the scam to spread rapidly through contact lists and social networks.

Warning signs consumers should watch for

Pennsylvania officials urged consumers to take extra precautions before opening invitation links or entering credentials online.

Red flags include:

• Invitations that unexpectedly require a password or account login

• Requests to download unfamiliar software or files

• Generic or poorly written invitations

• Links that do not match the claimed website destination

• Invitations that seem unusual or out of character for the sender

Consumers are encouraged to hover over links before clicking to inspect the destination URL and to independently verify suspicious invitations by text message or phone call.

What to do if you clicked

Officials said consumers who believe they may have interacted with a fraudulent invitation should act quickly.

Recommended steps include:

• Change email passwords immediately

• Enable two-factor or two-step authentication

• Review account recovery settings and connected devices

• Report the email as phishing or spam to the provider

• Monitor accounts for suspicious activity

What this means

Cybercriminals increasingly rely on “social engineering” tactics that exploit trust instead of obvious technical tricks. Fake package notices, shared documents, password-reset emails, and now digital invitations are designed to look routine enough that consumers lower their guard.

Security experts say the safest approach is to treat unexpected login requests with skepticism — even when messages appear to come from someone you know.