There’s a scam making the rounds that’s worth knowing about, and it’s effective because it starts with someone you actually know. You receive what looks like a party invitation from a friend through a service like Paperless Post or Punchbowl. The email really does come from their account, which has been compromised, but clicking any link takes you to a fake site asking for your email credentials. If you enter your password, your account is next in line, and from there the scammer can use email-based password resets to get into your financial and other sensitive accounts.

A few things to watch for: invitations that are vague on basic details like date and location, links that don’t go where you’d expect (hover on a Mac to preview, or touch and hold on iPhone or iPad), and any site that asks for your email password outside of your actual email provider’s login page. And yes, the “SAFE TO OPEN” label in the example below is a red flag, not a reassurance.

The most effective thing you can do is enable two-factor authentication on your email accounts. It stops account takeovers like this in their tracks, even if someone gets your password.

Not sure where your organization stands on threats like this one? We put together a quick IT Risk Assessment to help you find out.

Take the Free IT Risk Assessment

(Featured image generated by Adam Engst with ChatGPT)