FTC flags fake Evite invitations as a route into client accounts

The Federal Trade Commission flagged in a May 2026 consumer alert that fake invitations styled after Evite and Paperless Post ask recipients to enter their email username and password to view event details. Once inside, according to the FTC, scammers can take over the account and send the same bogus invitation to the victim's contacts. The warning is circulating again as Cybersecurity Awareness Month runs through October 2026.

Steve Czocher of Gresham Partners in Chicago says email is usually how passwords to financial accounts get reset, so one compromised inbox can hand criminals a route to significant assets. Czocher, a partner and director of family office services at the Chicago-based firm, says wealthy clients are most exposed through personal email, and that the risk climbs for clients still on older services such as Yahoo and AOL, or who have not turned on two-factor authentication.

The FBI's Internet Crime Complaint Center received 191,561 phishing and spoofing complaints in 2025, the most of any crime type, according to its 2025 Internet Crime Report, released in April 2026. Reported phishing losses roughly tripled to $215.8 million from $70 million in 2024, and total reported cybercrime losses hit a record $20.877 billion.

Accessing sensitive accounts on public Wi-Fi adds further risk, Czocher said. "A VPN can help protect the connection, but it cannot prevent phishing or account takeover on its own."

Brian Francetich, director of Golsan Scruggs RIA, which provides insurance and risk management to investment advisory firms, says the circle of professionals around a wealthy family widens the target. Advisors, attorneys, accountants, private bankers and family office staff each represent another channel an attacker can impersonate.

"In many cases, the underlying technology isn't the primary issue. The challenge is that the communication appears legitimate enough for a reasonable person to trust it, and the bad actors continue to get better at this," Francetich said.

Heather Sweeney, strategic partner manager at BlackCloak, says many affluent families lack at home the safeguards they rely on at work. Sweeney, whose digital executive protection firm is based in Lake Mary, Florida, adds that artificial intelligence is widening that gap. The FBI report counted 22,364 complaints referencing AI in 2025, with about $893 million in associated losses.

For a practice, the work this implies is checkable in a review meeting. A client-facing warning about invitation-themed password requests, an inventory of which clients still run on legacy email, two-factor authentication switched on across the household, and out-of-band verification for any request that arrives by email are all things an advisor can ask about directly. The FTC's own description of the takeover — the attacker mailing the same invitation to the victim's contacts — can put the advisory firm's staff on the receiving end of a message that appears to come from a client they know.