Last Updated on September 17, 2026 by Alan
A cheerfully worded email arrives in your inbox, supposedly from one of your friends, coworkers or relatives. It announces a party, celebration or other “special event”, and includes a link or button to click in order to see the actual invitation. When you click it, you’re taken to a page that asks you to log in with your email credentials. If you do so, your email account is instantly compromised, and that may lead to your shopping and financial accounts also being raided. Welcome to the email invitation scam.
This type of scam has been on the rise lately, and if it hasn’t hit your inbox yet it probably will before too long. Once they have your email login and password, the scammer can cause you a world of hurt and commit a host of crimes. For example, they can:
- change your password, thus locking you out of your own account
- delete all your messages (if they’re particular malicious)
- use your email address to unlock your bank, credit card, shopping or investment accounts
- rifle through your private messages in search of compromising information they can use to blackmail you
- mine your contact list so they can send the same scam email to all your contacts, this time posing as you
- use your email to send spam, deal in child pornography or commit various kinds of fraud
How To Protect Yourself
First off, NEVER enter your email login and password in response to any supposed invitation, even if it appears to come from someone you know and trust. There is absolutely no reason to provide those credentials (or any other sensitive information) just to view an invitation. If you think the invitation may be legitimate, contact the supposed sender directly to verify it. And in the unlikely event it is a real invitation, educate the sender on why they shouldn’t be using an invitation service that requires invitees to enter sensitive information.
More broadly, never use credentials from one website to log into another website. Unfortunately, many legitimate websites will give you the option of using your Gmail, Facebook or other common logins to gain access, rather than setting up credentials just for that site. This option may seem like a great convenience, as it frees you from having to keep track of yet another login and password, but it comes with a hidden danger, even if the website is completely legitimate and honest. If you use your email credentials to log into ten different websites they must be stored on all those sites, and that means those credentials have ten times the potential exposure to a data breach. And if any of those sites is breached, the hacker can now impersonate you on ALL of those sites, AND they may have control of your email account and with that be able to inflict all the damage outlined above.
Finally, be really serious about protecting all of your important accounts (email, financial, shopping, and cell phone) by following these best practices:
- Use strong passwords – at LEAST 8 characters long, including a mix of lower case and capital letters, digits and special characters, and not something that others may know or easily guess from your social media accounts (family member names, phone numbers, addresses, etc.). Also avoid commonly used choices like “12345678”, “asdfjkl;”, “password”, etc.
- Never use the same password for multiple accounts; otherwise, the exposure of just a single password could unlock multiple accounts all at once.
- Never reuse an old password.
- Enable two-factor authentication (2FA) for all accounts that offer it. With 2FA, in order to access an account you must provide other information (such as a code texted or emailed to you) in addition to the password before you can gain access, so that even if your password is compromised the hacker will probably not be able to get in.
- Enable a passkey whenever you have that option. Passkeys are an especially secure type of 2FA. They use a pair of encryption keys, each of which only works with the other. One is registered with the website or service that you’re logging into, and the other is stored securely on your computer, tablet, phone or other device. Once the passkey is set up, in order to complete a login you must unlock the key stored on the device by providing your fingerprint, face ID or device unlock PIN. Even if your device is stolen, the thief cannot use your passkeys because they won’t have the fingerprint, face ID or device unlock PIN needed to unlock them.
- Be especially careful to prevent your cell phone number from being hijacked. If a hacker knows your name and cell phone number, they can call the cell phone company pretending to be you, claim that they’ve lost the phone, and ask that the number be transferred to a new phone. If they succeed in doing that, your cell phone will suddenly stop working, and all the calls and texts intended for you will now go to the hacker’s phone. With that, they can quickly reset the passwords on your email and other accounts, which commonly involves having a code sent to your cell phone. Because of that, your cell phone is a critical point of failure in the security of all your accounts. To keep this from happening, contact your service provider and ask them to lock down your account so that no change can be made to the account without a special password being provided or in person with identity verified by photo ID. The exact procedure for this will vary from one provider to another.