The digital invitation in my inbox said: “Shhhhhhh. It’s a Surprise!”
But something triggered my spider senses.
The email address was legitimate. I double-checked. But it came from a fellow church member with whom I wasn’t close enough friends to be invited to a birthday party.
I took the risk of ruining the surprise by asking if I had, in fact, been invited to a party using Paperless Post, a digital platform for sending online invitations and greeting cards.
My instincts were right. It was a scam. The person’s email had been hacked.
Not long after that incident, I received another email, this time a party invitation purporting to be from Punchbowl, another online invite site.
“Please Join Us,” that one said, with a prominent green hyperlink box labeled “open invitation.”
I texted the friend whose email address was used to send that invite. She didn’t have any special occasions coming up, so I was immediately suspicious.
Nope, she was not having a party. In fact, she had been sent a similar invitation, but it was from someone in her social circle. “I initially opened it and saw it was asking to use my email [information] to open, so I deleted it,” she texted back.
As a fan of “Star Trek,” this particular scam reminds me of an old episode, “The Trouble with Tribbles.” In the Star Trek universe, tribbles are small, furry creatures that appear harmless (party invites) but can replicate at a staggering rate. A single fraudulent invite can quickly spread a scam to your entire circle of friends. If just one person in that group is scammed, their email can become compromised as well, which can lead to more fake invitations.
With an average of 14 scam messages arriving daily, Americans now spend about 114 hours a year filtering out fraud, according to recent McAfee data. The research shows that because these scams are now so realistic, many victims don’t realize they’ve been targeted until their accounts are taken over, their contacts have been stolen or they become victims of identity theft.
Over half of Americans report that a social media account was compromised in the past year, McAfee said.
“One of the patterns that we see is when scammers find something that works, they lean into it and we start seeing it at higher and higher scale until people become more immune to it,” said Steve Grobman, chief technology officer at McAfee.
Twice this year, scammers have created a fake Facebook account in my name. Each time, the apparent goal was to get someone to accept a friend request. From there, the ruse usually involves sending a direct message requesting money or encouraging investment in a fraudulent venture. It’s a calculated, predatory move impersonating a financial columnist. The fraudsters are betting that if you already trust my advice, you’ll be less likely to question a pitch that you would normally find suspicious.
In the most recent incident, a scammer impersonating me on Facebook reached out to a friend, writing, “Hi Nathalie! How are you doing today? Let me know when you get this text. I have something of value to share with you.”
The account looked legit, even copying and uploading videos from my real Facebook profile.
Fortunately, my friend reached out to confirm the message before engaging with the bad actor.
Fake accounts and invites are no mere annoyance. They are a growing problem that is stealing billions from people’s networks of friends, family and acquaintances.
The FBI this week released its annual Internet Crime Report, which found that Americans were defrauded of nearly $21 billion last year. Cloned accounts and fake invites often fall under the broader umbrella of impostor or investment fraud and are among the most frequently reported complaints. In this latest report, for the first time, the FBI tracked AI-facilitated fraud. Scammers are using fake social profiles, voice clones and deepfake videos, resulting in nearly $893 million in losses.
Fake “e-vites” are among the newer phishing traps, according to McAfee. Click on the invite link, and you may be taken to a page that asks for your email and password before you can view the invitation or RSVP. Scammers can then hack your email account, launch identity theft schemes or mine your contact list for other potential victims. Your friends may reasonably believe it’s you reaching out, because the message is coming from your legitimate email address.
In some cases, you might be manipulated to download malicious software that gives the fraudster access to your computer. Scammers often use Remote Access Trojans (RATs), which is a fitting name when deployed by digital rodents. Using this technology, a criminal can stay hidden and wait for you to log in to your bank or retirement account, allowing them to capture your login information. They can look through your files, where they may find a copy of your most recent tax return, then sell that sensitive information to other scammers.
Many scams are remarkably easy to spot. For instance, someone using the name “Cheryll Cook” keeps emailing me from a suspicious address with a message about a mystery photo. There are so many red flags that it goes straight to my spam folder.
Grobman says email providers can catch a lot of obvious spam, but standard filters are failing to catch these new schemes, which continue to get more believable with the assistance of AI. “In the case of our scam detector, we’re literally updating our threat intelligence around the clock,” he said.
Here’s how to spot a clone profile:
- Check the profile history. If it’s an account of a prominent person with only a few recent photos and no long-term activity, it’s a red flag.
- Be suspicious if a longtime friend sends a new friend request followed immediately by a direct message about an exclusive deal or investing opportunity.
- Be leery of efforts to move the conversation from the social media account to an email or encrypted app like WhatsApp. This can make it harder to track the scammer down.
Here’s how to spot a phony party invitation:
- Authentic invite emails come only from the digital platform. For example, Paperless Post issued a warning last month advising users that emails it sends would come from [email protected], [email protected] or [email protected]. Similarly, Punchbowl offered guidanceon identifying a fake invitation, saying the email will come from [email protected].
- If the invite comes from a personal Gmail, Yahoo or Outlook address, even if it uses a friend’s name, it’s a scam.
- A legitimate invite won’t prompt you to log in to your email using your password just to view the card. If you are required to do that, close the tab. They are trying to steal your login credentials.
- If the invitation is vague or missing details for the specific event, that can be a clue that a scammer is trying to lure you in.
These more sophisticated scams can bypass your skepticism because they mimic the people and platforms you trust. Because of that, my final piece of advice is trust nothing.
The post How digital thieves use fake profiles and invites to scam your friends appeared first on Washington Post.
