Online Threat Alerts (OTA) - Alerting you to scams and frauds.
Punchbowl Invitation Scam - Beware

Fake Punchbowl invitation scams are highly sophisticated phishing attacks designed to steal your login credentials or infect your device with malware. These scams often appear as legitimate party invites from someone you know, which lowers your guard.

How the Scam Works

  • The Lure: You receive an email or text that looks like a real event invitation (e.g., a wedding or birthday).
  • The Trap: Clicking the link redirects you to a fraudulent site that may:
    • Prompt you for a Google/email login to "view" the invite, effectively stealing your password.
    • Attempt to download malware (often an .msi or .exe file) disguised as the invitation details.
    • Request payment for "guest fees" or "gift funds".
  • The Payload: Once compromised, the scam may automatically send the same fake invite to everyone in your contact list, continuing the cycle.

Key Red Flags

  • Suspicious Sender: Legitimate Punchbowl emails only come from mail@mail.punchbowl.com.
  • Desktop-Only Requests: Scammers often tell you to "open on a laptop/desktop" for the best experience—this is because their malware is often designed specifically for PCs and might not work on mobile.
  • Mismatched URLs: Hover over the link without clicking; if it doesn't start with https://www.punchbowl.com, it is a scam.
  • Unexpected Attachments: Real Punchbowl invites never contain attachments.

What to Do if You Clicked

  1. Change Passwords: Immediately update your email and any accounts that share that password.
  2. Enable 2FA: Turn on two-factor authentication (MFA) to prevent further unauthorized access.
  3. Run a Malware Scan: Use reputable software to check for hidden threats.
  4. Warn Your Contacts: Let friends and family know your account may have been compromised so they don't click on links sent from your name.
  5. Report the Phish: Forward the email to help@punchbowl.com or abuse@punchbowl.com.
waiting