Punchbowl invitation scam: how to spot a fake invite
Quick answer
A "Punchbowl" invitation that asks you to sign in with your email and password, comes with an attachment, or links anywhere other than punchbowl.com is fake. Don't open it. Forward it to help@punchbowl.com, mark it as spam and change your email password if you clicked.
- Comes by
- Pretends to be
- Punchbowl
- Last updated
How it works
Scammers send emails that look like a Punchbowl invitation or greeting card, often from a friend's hacked email account, which is how it spreads.
Punchbowl's help center says the fake versions tend to show up in one of two ways: a page that asks for your email address and password before it will show the invitation, or an email with an attachment. Real invitations can be viewed without signing in and don't need an attachment.
What the scammer wants is your email login, which opens the door to your other accounts and lets them send the same fake invite to your contacts.
Red flags
- A sign-in page that asks for your email and password to see the invitation
- An attachment on an invitation email
- A link that doesn't start with https://www.punchbowl.com
- A sender address that isn't Punchbowl's, even when it's a friend's real email
- An invitation to an event you weren't expecting
Example message
You're invited! [Friend's name] sent you an invitation. View the details and RSVP here: [link]
What to do
- 1
Don't open it or click anything
Hover over a link without clicking to see where it goes. If it isn't punchbowl.com, delete the email.
- 2
Forward it to Punchbowl and mark it as spam
Punchbowl's help center asks you to forward fakes to help@punchbowl.com.
- 3
If you entered your email and password, change it now
Change the password on that email account first, then any account that shares the password. Turn on two-step verification.
- 4
Check with the sender
If it came from a friend, tell them through a text or call that their account may be hacked.
- 5
If friends got invites you never sent
Your email account may be compromised. Change the password and check your account's sent folder and recovery settings.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
A fake invite from a friend's hacked account lands in your inbox because your email address is in their contacts. Your email address also sits on people-search sites and in breach dumps.
Servus finds where your phone number, address and email are listed on data brokers and people-search sites and removes them, and alerts you when your details show up in a breach. That gives fewer scammers something to work with. Our guide on what to do after a data breach covers the next steps if your details already leaked.
Frequently asked
Is Punchbowl a scam?
No. Punchbowl is a real invitation service whose name is copied by scammers.
The invite came from my friend's real email. Is it safe?
Not necessarily. Punchbowl says even an email from a friend's genuine account can be fake, because hacked accounts are how this spreads.
Do real Punchbowl invitations ask me to sign in?
No. Punchbowl says real invitations can be viewed without signing in to an account.
I clicked the link. What now?
Don't enter anything. If you did enter your email and password, change that password now and turn on two-step verification.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
