A reassuring reply may not prove an invitation is safe

When an unexpected invitation arrives from a friend, checking with them before clicking can seem like the sensible thing to do. But what if the reply comes from an email account that a scammer has already taken over?

John, who lives in Westlake, Ohio, received a suspicious Evite invitation. Remembering earlier warnings about fake invitations, he contacted his friend by email rather than opening the message. The reply said the invitation was genuine. Something about its wording and punctuation didn’t sound right, though, so John checked with his friend another way. He then learned that the invitation was a scam.

The invitation looked polished and included a “View Invitation” button for a supposed dinner gathering. The reassuring reply left John wondering whether someone had access to his friend’s email account, or had set up an automatic response. There’s no evidence showing how the reply was created. It may have been sent manually, generated automatically or produced in some other way. But the episode is a reminder that a reply from a familiar address isn’t always proof that a message is legitimate.

How a scammer could answer for someone else

The Federal Trade Commission warned in May 2026 about fraudulent invitations that imitate services such as Evite and Paperless Post. A message may appear to come from someone you know, then direct you to a fake page that asks for your email password or a verification code.

If criminals gain control of an account, they can use it to send more deceptive messages to the account owner’s contacts. They may also be able to see replies. In that situation, someone who emails to check whether an invitation is real could receive an answer from the person controlling the account.

Email services such as Gmail let users create filters and automatic replies. Someone with unauthorized access might misuse those tools, or simply respond while pretending to be the account owner. In John’s case, however, it isn’t known whether anyone accessed his friend’s account or how the reply was sent.

Evite said it was not seeing an increase in phishing scams and advised people to look closely at an invitation’s details. A vague message with little more than “You’re invited” and a link deserves caution, the company said. Specific details can help make a real invitation feel more credible—but scammers can add those, too, so detail alone isn’t a guarantee.

Safer ways to check an invitation

• Contact the sender by phone using a number you already have, or through another communication channel you know is theirs. Don’t rely on contact details supplied in the suspicious message.
• Be wary of invitations that ask you to enter an email password or share a security code before you can see the event details.
• If you use the service named in the invitation, open its official app or type its website address yourself. Check your account there instead of following an unfamiliar link.
• Notice when a message’s tone or writing seems unusual, but don’t treat spelling or punctuation as a reliable test. Scammers can write convincingly, and genuine messages can contain mistakes.
• Be especially cautious if a supposed host follows up with another unexpected link or asks you to download something.

Some scams use fake invitation files to deliver harmful software, including programs that can give someone remote access to a device. Keep your operating system and security software updated. If you downloaded a suspicious file, don’t open it; scan your device with trusted security software. If you entered your password on a questionable site, change it through the legitimate service as soon as possible.

If you’re concerned about an email account

Review the account’s recent activity and settings for changes you don’t recognize, including unfamiliar forwarding rules or automatic replies. Remove unauthorized changes, update your password from a trusted device and sign out of sessions you don’t recognize.

Use a strong, unique password and turn on two-factor authentication or a passkey if available. Passkeys can help protect against phishing because they’re tied to the legitimate app or website. A password manager can also make it easier to avoid reusing the same password across services.

If you receive a suspicious invitation, report it using your email provider’s phishing-reporting tool. You can also report scams to the Federal Trade Commission. If the message appears to come from a friend, let them know through a trusted channel so they can check their account and warn other recipients if needed.

If your friend confirms that their account was accessed without permission, don’t interact with the invitation. Keep a copy of the message and encourage them to start account recovery through their provider’s official website. They should review account activity, remove unfamiliar access and alert anyone who may have received a similar message.

John’s experience complicates a piece of advice many people hear: contact the sender when a message feels suspicious. That’s still useful, but the channel matters. If an email account has been compromised, replying to it may put you in touch with whoever took it over. Calling a number you already trust can be a safer check.

John didn’t accept the reassuring reply at face value. That extra follow-up helped him establish that the invitation was fraudulent. A familiar name—or even a reply from a familiar address—doesn’t always settle the question.