Punchbowl Invitation Scam

How the Scam Works

• The Lure: You receive an email or text that looks like a real event invitation (e.g., a wedding or birthday).
• The Trap: Clicking the link redirects you to a fraudulent site that may:
  • Prompt you for a Google/email login to "view" the invite, effectively stealing your password.
  • Attempt to download malware (often an .msi or .exe file) disguised as the invitation details.
  • Request payment for "guest fees" or "gift funds".
• The Payload: Once compromised, the scam may automatically send the same fake invite to everyone in your contact list, continuing the cycle.

Key Red Flags

• Suspicious Sender: Legitimate Punchbowl emails only come from mail@mail.punchbowl.com.
• Desktop-Only Requests: Scammers often tell you to "open on a laptop/desktop" for the best experience—this is because their malware is often designed specifically for PCs and might not work on mobile.
• Mismatched URLs: Hover over the link without clicking; if it doesn't start with https://www.punchbowl.com, it is a scam.
• Unexpected Attachments: Real Punchbowl invites never contain attachments.

What to Do if You Clicked

1. Change Passwords: Immediately update your email and any accounts that share that password.
2. Enable 2FA: Turn on two-factor authentication (MFA) to prevent further unauthorized access.
3. Run a Malware Scan: Use reputable software to check for hidden threats.
4. Warn Your Contacts: Let friends and family know your account may have been compromised so they don't click on links sent from your name.
5. Report the Phish: Forward the email to help@punchbowl.com or abuse@punchbowl.com.