Got a Punchbowl invitation email? Is it real?

An email says you are invited, with a button to view the invitation, and it seems to come from a friend, a relative or a colleague. If one like that arrived, here is what the sources say.

What's circulating

On help.punchbowl.com, the company writes: “Punchbowl has received reports of phishing emails that imitate our brand and appear to be Punchbowl invitations. These scam emails are not sent through our platform and are not associated with our company in any way.”

A television station reports on fox5vegas.com: “Punchbowl did not send these invitations. They come from cybercriminals who use the links to install malware on victims’ devices.”

A police warning reported on wwlp.com: “The scheme uses messages that appear to be from “Punchbowl,” a popular digital greeting card and party invitation website. The fraudulent emails contain links that download malware onto a user’s device when clicked.”

Why the sender looks familiar, on cbsnews.com: “The addresses that appear to be sending the invitations are legit, likely stolen from previously hacked friends and family.”

How to check a Punchbowl invitation

• The sender: help.punchbowl.com says that all legitimate Online Invitations and Digital Greeting Cards sent from Punchbowl via email will come from mail@mail.punchbowl.com.
• The link: help.punchbowl.com says that Invitation and Card links always start with https://www.punchbowl.com.
• Attachments, on help.punchbowl.com: “It is important for you to know that legitimate emails from Punchbowl will never contain an attachment.”
• The sign-in, on help.punchbowl.com: “All Punchbowl Invitations and Digital Cards can be viewed without signing in to an account. If you are asked to sign in, do not enter any personal information.”
• By text message, on help.punchbowl.com: “All legitimate Online Invitations and Digital Greeting Cards sent from Punchbowl via text message in the U.S. will come from our short code: 90403.”
• Odd requests, on fox5vegas.com: “Unusual requests, such as asking users to open a link on a laptop, are red flags.”
• Other addresses, on fox5vegas.com: “Personal email accounts or odd-looking web addresses indicate the invitation is not from Punchbowl.”
• Before you open the button, rest the pointer on it, or press and hold it on a phone, and read the web address it leads to.

What to do with the email

• Leave the button and the links unopened, and type no password anywhere it sends you.
• Ask the host whether they sent it, by a call or a message you start yourself, never by replying to the email.
• Where to send it: help.punchbowl.com asks you to forward the email to help@punchbowl.com.
• And then, on help.punchbowl.com: “Mark the email as spam within your inbox.”
• Got the email and still unsure? Paste its text into VOM, without your password or any code.

I already typed my password. What now?

• Change the password of the email account you typed first, from a device you trust, and then every other account that used the same password.
• Turn on two-step verification for that email account.
• If a file downloaded or a page asked you to install something, run a full scan with your security software.
• Warn the people you write to, as cbsnews.com puts it: “Also, warn contacts to ignore a surprise 'Punchbowl' invitation and be extra cautious clicking on any link now and in the months ahead.”
• If your friends got an invitation from you that you never sent, help.punchbowl.com says: “If recipients have received an Invitation or Card from you that you didn't send, we recommend that you update your email account password.”
• Report it: aarp.org says you can report scams to Evite at support@evite.com, Paperless Post at phishing@paperlesspost.com and Punchbowl at help@punchbowl.com.

Frequently asked questions

Could it be fake if it came from my friend's own address?

Yes. On cbsnews.com: “The addresses that appear to be sending the invitations are legit, likely stolen from previously hacked friends and family.”

Ask your friend by a call or a message you start yourself.

Should you sign in to see the invitation?

On help.punchbowl.com: “All Punchbowl Invitations and Digital Cards can be viewed without signing in to an account. If you are asked to sign in, do not enter any personal information.”