The email looks exactly right: a friend’s name, a cheerful invitation from a platform you recognize, and one small request to sign in and view it. That request is the tell. In 2026, fake digital invitations have become one of the most active phishing lures in consumer email, convincing enough that the Federal Trade Commission issued a consumer alert about them in May. This guide shows you how to verify a real invitation in about a minute, the red flags that give fakes away, and exactly what to do if you already clicked.
These habits apply to invitations from any platform. The guide is published by Greenvelope, whose invitations never require a login to view, and that principle is worth remembering up front: a genuine digital invitation opens for you freely, while a fake one puts a sign-in wall between you and the party.
Why Fake Invitations Are Everywhere in 2026
The FTC’s May 2026 alert describes unexpected “You’re invited” emails and texts dressed up as well-known invitation platforms, which then ask recipients to enter an email address and password to view the invitation. Security researchers tracking the campaign have identified roughly 80 phishing domains built for it since December 2025, many of them spoofing the familiar “Sign in with Google” and “Sign in with Microsoft” screens. Evite reports a notable rise in these scams since early 2026, with fakes borrowing its branding and formatting, and other major platforms have acknowledged the same wave.
The scam usually runs in a chain. A victim enters their email password on a fake sign-in page. The scammers then use that account to send convincing fake invitations to everyone in the victim’s contacts, which is why so many of these arrive from the real address of someone you genuinely know. Some variants skip credentials entirely and push a file download that installs malware instead.
It works because invitations exploit two reliable instincts: trust in a familiar name, and the pull of not wanting to miss something. Fortunately, verification takes about a minute.
The 60-Second Verification Checklist
- Check the actual sender address, not the display name. Real platform invitations come from the platform’s own domain. A display name that says a friend’s name over an unrelated address is a classic mismatch.
- Hover before you click. On a computer, hover over the invitation button and read the destination in the corner of your browser or mail client. Real invitations link to the platform’s own domain, such as greenvelope.com or evite.com. A lookalike address with extra words or characters is a fake.
- Treat any sign-in wall as a stop sign. A genuine invitation does not require an account or password to view. Greenvelope invitations, for example, open and accept your RSVP with no login at all. A popup asking you to sign in with Google or Microsoft just to see a party invitation is the current scam’s core move.
- Look for verified-sender marks. In Gmail, Apple Mail, and Yahoo, authenticated senders can display a verified brand logo and blue checkmark beside the message. Its presence is reassuring; its absence on a message claiming to be from a major platform is a caution.
- Confirm with the host another way. If the invitation is unexpected or out of character, text or call the person who supposedly sent it. Do not reply to the email itself, since a compromised account answers as the scammer.
- Notice pressure. Urgency, expiring links, and “view now before it’s gone” language belong to phishing, not parties. Real invitations wait patiently for your RSVP.
Red Flags at a Glance
| Red flag |
Why it matters |
What to do |
| You must sign in to view the invitation |
Credential theft through fake login screens is the scam’s primary mechanism |
Close it and verify with the host directly |
| The link does not lead to the platform’s own domain |
Lookalike URLs are built to pass a quick glance |
Hover before clicking, or type the platform’s address yourself |
| The invitation is an attachment, especially .exe, .zip, or .html |
Real invitations are links, not files; attachments can carry malware |
Do not open it; report and delete the message |
| Urgent or expiring language |
Manufactured pressure is a phishing pattern, not party planning |
Slow down and run the checklist above |
| An unexpected invite that feels out of character |
Compromised accounts send fakes to their entire contact list |
Text or call the sender through a channel you already trust |
What Real Invitation Platforms Never Ask
A legitimate digital invitation will never ask for your email password to view it, never require payment or gift cards to RSVP, never ask you to download software to open it, and never request access to your contacts. For ticketed events, payment happens on the platform’s own domain through a normal checkout, never through a login popup or an unusual payment method. If an invitation asks for any of these, the party is not real.
If You Already Clicked
Take a breath; quick action fixes most of it.
- Stop at the door. If a page is asking you to sign in or download something, close it. Clicking the link alone is usually recoverable; entering credentials is what the scam needs.
- If you entered a password, change it now. Start with the email account, then anywhere the same password is reused, and turn on two-factor authentication so a stolen password is not enough on its own.
- If you downloaded anything, run a scan. Use reputable antivirus software and disconnect from the internet while it runs if you suspect malware.
- Check your sent folder. If your account was used to spam your contacts, warn them so the chain stops with you, and tell the friend whose name arrived on the fake so they can secure their own account.
- Report it. Mark the message as phishing in your mail client, forward scam emails to reportphishing@apwg.org and scam texts to 7726, per FTC guidance. If a fake carries Greenvelope branding, forward it to support@greenvelope.com so the team can act on it.
For Hosts: Send Invitations Guests Recognize
Hosts can make verification easy. Send from your own name with a short personal note, give guests a heads-up for large events so the invitation is expected, and choose a platform that authenticates its mail. Greenvelope invitations are sent through authenticated domains, display the verified Greenvelope logo and checkmark in supported inboxes, link only to pages hosted on greenvelope.com, and open without any login, which together give guests every signal on the checklist above. The team’s guide to verifying Greenvelope invitations lists the exact sender addresses, and the pre-send deliverability checklist covers the rest of getting real invitations recognized and delivered.
Frequently Asked Questions
Is Greenvelope legit?
Yes. Greenvelope is a digital invitation platform founded in Seattle in 2008, used by hosts for weddings, corporate events, and celebrations, and it holds a 4.9-star Trustpilot rating across more than 10,000 reviews. A real Greenvelope invitation links only to greenvelope.com and never asks you to log in, pay, or download anything to view it. If a message claiming to be from Greenvelope does any of those things, it is an imitation; forward it to support@greenvelope.com to confirm.
Why is an invitation asking me to log in to view it?
Because it is almost certainly fake. Requiring a login to view an invitation is the signature move of the current phishing wave described in the FTC’s May 2026 alert, which uses spoofed “Sign in with Google” and “Sign in with Microsoft” screens to steal email passwords. A genuine invitation, including every Greenvelope invitation, opens and accepts your RSVP with no account, login, or payment. Close the page and verify with the host directly.
How can I tell if a digital invitation is fake?
Check the actual sender address against the platform’s real domain, hover over the button to confirm the link leads to that same domain, and treat any request to sign in or download a file as a stop sign. When in doubt, confirm with the host by text or phone rather than replying to the message.
Is it safe to open a digital invitation email?
Opening and reading the email is generally safe. The risk begins when you click a link and then enter credentials or download a file, so verify the sender and the link destination before clicking, and never sign in just to view an invitation.
Why would a scammer send a fake party invitation?
Mainly to steal email credentials through a fake sign-in page, which lets them take over the account and send more fakes to every contact. Some variants deliver malware through a download instead. Invitations work as bait because they arrive with a trusted name attached and curiosity does the rest.
What should I do if I clicked a link in a fake invitation?
If you entered a password, change it immediately, starting with your email account, and enable two-factor authentication. If you downloaded anything, run an antivirus scan. Check your sent folder for messages you did not write, warn affected contacts, and report the message as phishing.
How do I verify a Greenvelope invitation specifically?
A real Greenvelope invitation arrives from a Greenvelope sender address, links only to pages on greenvelope.com, opens without any login, and displays the verified Greenvelope logo in inboxes that support authentication marks. If you are ever unsure, forward the message to support@greenvelope.com and the team will confirm whether it is genuine.
Related Resources
Explore more guides in the Greenvelope resource hub: