A Paperless Post scam email may look like a cheerful invitation from someone you know, then send you to a page asking for your Google, Microsoft, Yahoo, or email password. A genuine Paperless Post invitation opens without requiring your mailbox password, a separate download, or an attachment.
Paperless Post is a legitimate invitation service. The scam is an impersonation of the brand, sometimes sent from a contact whose email account was already compromised.
Short answer
Do not use an invitation link if the next page asks for your email password, a security code, an attachment download, or software. Verify the event with the supposed host through a phone number or conversation you already trust, then compare the message with the invitation service's official domains.
Why these fake invitation emails feel convincing
An invitation does not feel like a security alert. It may mention a wedding, birthday, retirement, memorial, or work event. That friendly context makes the button feel routine.
The message may also come from a real person's compromised inbox. Paperless Post says recent phishing messages have been sent from the addresses of people the recipient knows. North Carolina DOJ described the same goal in its June 2026 consumer alert: steal an email login, take over the inbox, and send more fake invitations to the victim's contacts.
The useful check is not whether you recognize the sender's name. It is whether the destination and request match a normal invitation.
Real versus suspicious Paperless Post invitation
Paperless Post's official phishing guidance says genuine invitations do not require a login or download and do not include downloadable attachments.
| Check | Normal Paperless Post flow | Suspicious invitation |
|---|---|---|
| Viewing the invitation | Opens directly | Requests an email or company login |
| Link destination | paperlesspost.com, pp.events, or links.paperlesspost.com | Lookalike or unrelated domain |
| Files | Embedded invitation content | PDF, ZIP, EXE, MSI, or "viewer" download |
| Security request | No mailbox password or one-time code | Requests Google, Outlook, Yahoo, or work credentials |
| Context | Event and host make sense | Unexpected event, vague host, or urgent expiration |
Official Paperless Post invitation and transactional messages use the sender addresses listed in its help center, including paperless@email.paperlesspost.com, paperlesspost@paperlesspost.com, and paperlesspost@accounts.paperlesspost.com. A visible sender name is not enough; check the full address and the link destination.
Do not paste a suspicious URL into the address bar. Use our guide to check a link without clicking it and compare only the domain.
Greetings Island scam invitations use the same trick
Greetings Island is also a legitimate invitation and card service. On its current Trust & Safety page, the company says it has received reports of phishing messages that imitate its brand. It also says the messages originate outside its platform and that its systems were not breached.
A real Greetings Island card opens in a browser without requiring your email password or a file download. Its official links use greetingsisland.com or rsvp.online. Its published invitation senders are dispatch@greetingsisland.com and dispatch@mail.greetingsisland.com; support uses support@greetingsisland.com.
A fake Greetings Island invitation may:
- Come from a familiar personal or work inbox that was compromised.
- Ask you to "sign in with Google," Outlook, or Yahoo to view the card.
- Use an unrelated destination hidden behind a button.
- Claim the invitation expires unless you act immediately.
- Include an attachment or software download.
The safest response is the same for both brands: contact the apparent host separately and open the invitation only after the destination and context make sense.
What to do before clicking RSVP or View invitation
- Ask the host about the invitation by text, call, or an existing conversation.
- Check the full sender address, not just the display name.
- Preview the link and compare only the registered domain.
- Do not open unexpected attachments or install a "desktop viewer."
- Never enter an email password or one-time code to view a card.
- If the invitation arrived by SMS, do not assume the shortened link is safe merely because the message has branding.
If an attachment is involved, follow the steps in Is this email attachment safe? before opening it. A PDF can be part of a harmless message, but an unexpected invitation should not require one.
What to do if you already clicked
Clicking alone does not prove that your account or device was compromised. What happened next determines the response.
You opened the page but entered nothing
Close it. Do not return to investigate. Report the message as phishing and run your device's current security checks if the page triggered a download or unusual prompt.
You entered your email password
- Open your email provider directly and change the password.
- Use a unique password that is not shared with other accounts.
- Turn on two-factor authentication or a passkey.
- Sign out unfamiliar sessions and review recovery email addresses and phone numbers.
- Check forwarding rules, sent mail, deleted mail, and connected apps.
- Warn contacts if your inbox sent invitations you did not create.
A compromised contact can make the next message feel unusually personal. Our spear-phishing guide explains why real names and familiar threads are not proof.
You downloaded or installed something
Disconnect if the device begins behaving strangely. Update trusted security software, run a scan, and ask a qualified IT professional for help if you installed software or granted remote access. Do not call a support number supplied by the suspicious page.
How to report the fake invitation
- Forward suspected Paperless Post impersonations to
phishing@paperlesspost.com. - Forward suspected Greetings Island impersonations to
support@greetingsisland.com. - Use your email provider's Report phishing control.
- Report identity theft or an email takeover at IdentityTheft.gov.
- If money or financial information was involved, contact the bank through its official app or the number on the card.
Do not forward a malicious attachment to friends or coworkers as a warning. Share a screenshot with private information removed, or describe the subject line and pattern.
Frequently asked questions
Do I need an account to view a Paperless Post invitation?
Paperless Post says a recipient can open a genuine invitation directly. A page asking for your mailbox password or a separate download is not a normal viewing step.
Can a real contact have sent the fake invitation?
The message can come from a real but compromised account. Confirm with the person through another channel before trusting the invitation.
What if the URL looks almost correct?
Almost is not enough. Check the registered domain, not the words elsewhere in the URL. Paperless Post publishes its three legitimate domains, and Greetings Island publishes two.
Does every fake invitation install malware?
No. Current official warnings focus heavily on stolen email credentials. Other variants may request downloads or attachments, but you should describe only what the message actually did.
The safest next step
Verify the event with the host before opening the invitation. If the page asks for your email password, security code, attachment, or software, stop.
For another layer of protection, Rampart is available for iPhone. It filters suspicious SMS and checks connected Gmail and Outlook accounts for phishing signals while keeping private messages private from family members. Download Rampart from the App Store.
Sources
- Paperless Post, spotting fake emails and spam texts.
- Greetings Island, how to know whether an invitation or card is real.
- North Carolina Department of Justice, Party Foul! Watch Out for Fake Email Invitations, June 16, 2026.
- FTC, IdentityTheft.gov recovery planning.