Punchbowl invitation scam: how to spot a fake invite
Quick answer
A "Punchbowl" invitation that asks you to sign in with your email and password, comes with an attachment, or links anywhere other than punchbowl.com is fake. Don't open it. Forward it to help@punchbowl.com, mark it as spam and change your email password if you clicked.
- Comes by
- Pretends to be
- Punchbowl
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
How it works
Scammers send emails that look like a Punchbowl invitation or greeting card, often from a friend's hacked email account, which is how it spreads. The FTC has also warned about fake party invites that ask for your email login or a code to open them. Punchbowl's help center says real invitations and cards come from mail@mail.punchbowl.com, link to https://www.punchbowl.com, never carry an attachment, and can be viewed without signing in to an account. A message that asks you to sign in first is a warning sign. What the scammer wants is your email login, which opens the door to your other accounts and lets them send the same fake invite to your contacts.
Sources checked: help.punchbowl.com, consumer.ftc.gov
Last verified against the official page:
Red flags
- A sign-in page that asks for your email and password to see the invitation
- An attachment on an invitation email (Punchbowl says real ones never have one)
- A link that doesn't start with https://www.punchbowl.com
- A sender that isn't mail@mail.punchbowl.com, even when it's a friend's real email
- A text invitation that doesn't come from short code 90403 (US)
- Broken layouts, ALL CAPS or red text in the message
Example message
You're invited! [Friend's name] sent you an invitation. View the details and RSVP here: [link]
Seen in the wild
- The FTC reported unexpected "You're invited" texts and emails imitating invitation platforms like Evite and Paperless Post. Some named someone you know as host and asked for your email login, or for your phone number and a code, to see the event details. text · consumer.ftc.gov
What to do
- 1
Don't open it or click anything
Hover over a link without clicking to see where it goes. If it isn't punchbowl.com, delete the email.
- 2
Forward it to Punchbowl and mark it as spam
Punchbowl's help center asks you to forward fakes to help@punchbowl.com.
- 3
If you entered your email and password, change it now
Change the password on that email account first, then any account that shares the password. Turn on two-step verification.
- 4
Check with the sender
If it came from a friend, tell them through a text or call that their account may be hacked.
- 5
If friends got invites you never sent
Your email account may be compromised. Change the password and check your account's sent folder and recovery settings.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
A fake invite from a friend's hacked account lands in your inbox because your email address is in their contacts. Your email address also sits on people-search sites and in breach dumps. Serus finds where your phone number, address and email are listed on data brokers and people-search sites and removes them, and alerts you when your details show up in a breach. That gives fewer scammers something to work with. Our guide on what to do after a data breach covers the next steps if your details already leaked.
Frequently asked
Is Punchbowl a scam?
No. Punchbowl is a real invitation service whose name is copied by scammers.
The invite came from my friend's real email. Is it safe?
Not necessarily. Punchbowl says even an email from a friend's genuine account can be fake, because hacked accounts are how this spreads.
Do real Punchbowl invitations ask me to sign in?
No. Punchbowl says real invitations can be viewed without signing in to an account.
I clicked the link. What now?
Don't enter anything. If you did enter your email and password, change that password now and turn on two-step verification.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- The page now cites the FTC's May 2026 alert about fake party invitations.
- Added Punchbowl's official sender address and text short code, and fixed a typo in the Serus paragraph.
