A recent victim of the "Punchbowl evite" phishing scam saw their Google account compromised, leading to the theft of $45 in rewards points. The individual, who wished to remain anonymous, discovered scammers used their stolen credentials to purchase a Macy's gift card. This incident highlights ongoing threats leveraging seemingly innocuous digital invitations.
The scam typically begins with an email designed to look like a Punchbowl invitation. Clicking the embedded link redirects users to a fraudulent login page, not the authentic Punchbowl site. Entering email credentials on this fake page allows attackers to steal account access. The victim noted their compromise occurred specifically upon attempting to sign in, not merely by clicking the initial link.
Once inside the Google account, the attackers quickly moved to exploit linked services. They accessed Capital One Shopping, which permits login via Google credentials. The victim had $45 in rewards credit within this shopping account. Scammers swiftly used these points to buy a $45 Macy's gift card. An attempt to log into American Airlines was unsuccessful, as the victim did not have an account with the airline, and direct Google login was not supported.
The victim realized a breach had occurred when automated email replies from unknown addresses began appearing, followed by texts and messages from contacts asking about the legitimacy of new invitations. The scammer had used the compromised Gmail account to send out fake "memory-making celebration" invitations to contacts accrued over 15-20 years. This widespread distribution caused considerable personal embarrassment for the victim.
Immediate action involved changing the Google account password and ensuring all other devices were logged out. The victim then used Google's "My Activity" feature to trace the scammer's digital footprint, observing the exact steps taken, including the Capital One Shopping access and gift card purchase. The Macy's gift card was still unredeemed hours after the hack. The victim quickly used the gift card to purchase swimming trunks from the Macy's website, recovering the value.
Such phishing attempts underscore the importance of vigilance with email links. Users should verify invitation authenticity by navigating directly to the official service website rather than clicking links in suspicious emails. Enabling multi-factor authentication (MFA) on email and other critical accounts provides a crucial layer of defense, even if passwords are stolen, by requiring a second verification step. The Federal Trade Commission offers extensive resources on identifying and reporting phishing scams.