A Blonde and Clever Phishing
A day like any other day.
Morning chores always include running through emails, and like many others I have a few accounts.
It was while tidying up the kitchen that I noticed something was wrong. I was logged out of YouTube, so I was unable to listen to my subscribed channels. I tried to log in and couldn’t. Hmmm. 
Then I got a call from a friend who asked me if I had sent an “evite,” which, oddly enough, contained a picture of the two of us taken at an outing about a year earlier. I had not. And the pieces began to fall into place.
I warned my friend not to click on the link as I immediately recalled an evite that I had gotten from another friend about a week earlier, apparently from her email account and otherwise unremarkable. I had opened it, and clicked on the link – there were no grammatical or image or even email address abnormalities (more on that later!) about the invitation that stood out – though when asked to create a password I got out as quickly as I could, realizing it could be a phishing scheme. When a week went by with no problem or further word from my friend – whom I alerted – I assumed all was good.
And then I tried to log onto my main email account.
No go. After a couple of attempts, I was completely shut out. I tried repeatedly, using the code-to-the-phone secondary authentication technique, but time and again was told there had been “too many attempts,” and I had to wait and try again in a few hours.
Of course nothing can be quite so reassuring as waiting around wondering what’s being done with your account while you’re locked out.
And then I began to tally up the number of additional services that were downstream of that email account, and reckoned that this incident was likely to cause a lot of trouble.
And the phishing technique was clever – I’m usually the one scolding others for opening an obviously fake email, or answering too many questions in a clearly phony phone call. In this case, it would have been hard to know it wasn’t real, though evidently many who got this one later in the game did ask me first if I, who may not have been in touch with them for months or even years, had contacted them. Smart! And there’s tip number one – something very unusual from someone you haven’t heard from in years, be suspicious!
Evite itself warns users to check the email from which the message comes. I thought I was safe as the email appeared to come from an actual friend. Evite warns: “Phishing emails will sometimes use what look like personal email or Gmail addresses to send. This is a clear red flag. Evite will never send from a gmail.com, yahoo.com, hotmail.com, or any personal email address.” So first step: if the email is coming from your friend and not Evite itself – don’t open!
They also caution: “2: Hover over links before clicking. Before clicking any button or link in an email, hover your mouse over it (on desktop). The destination URL will appear in the bottom-left corner of your browser or email client. 
Example:
Step 1: Hover over the “View & RSVP” button or any link in the email.
Step 2: Look at the URL that appears at the bottom of your screen.
Real Evite links go to https://evite.com or https://evite.me. Scam links go somewhere else entirely.
Key rule: If the hovered URL does not contain evite.com as the main domain, treat the email as a phishing attempt regardless of how legitimate it looks.”
Basically, whether its Evite or some other provider of invitation services, look carefully to see who’s sending the email, and use the hover technique to further determine where your “click” is taking you!
It was as I was complaining to an associate, specifically about my inability to fulfil a request because I was locked out of the tool needed, that I was introduced to the hero of the story.
John Rice is a young man working in technology and security for the defense and banking industries. He holds an AAS in Information Systems, and a BS in Information Technology, complemented by continuing education in cybersecurity through UC Berkely, MIT and SU. His industry certifications include Security+, MCSE, and CEH.
All of which is to say, he knows a lot more than most of us, particularly about security and recovery after a breach.
I thought it might be interesting to ask him a few questions about this, and other similar episodes. And the motherlode of information I got on the subject was every bit as expert as the assistance he offered.
Q: Are phishers getting better, or at least a little more cloaked? It seems like their spelling and grammar errors used to be dead giveaways.
A: Absolutely. Phishing attacks have become significantly more sophisticated, particularly with the introduction of artificial intelligence. Years ago, poor grammar, misspellings, and questionable formatting were often immediate indicators of a scam. Today, attackers can use AI to generate extremely convincing emails that closely resemble legitimate communications from banks, businesses, and even people you know.
What concerns me more is that attackers are increasingly using legitimate services and compromised accounts to distribute these messages. An email can appear completely authentic because it actually originated from a trusted platform or someone’s legitimate email account. The days of identifying phishing attempts simply by looking for spelling mistakes are largely behind us.
Q: This Evite scam was new to me – and I can remember the old days of the Nigerian Prince telling you he needed to put his millions in your bank account to secure it. What ARE the latest games being played?
A: The Nigerian Prince scams almost seem funny and naive compared to what we’re seeing today. Attackers have shifted toward exploiting people’s trust in familiar services and everyday activities.
We’re seeing fraudulent invitations, fake package delivery notifications, QR code scams, fraudulent Microsoft 365 and Google security alerts, and even attackers impersonating technical support personnel. Another growing concern is the use of AI-generated voices and deepfake videos to impersonate family members, coworkers, or executives.
One particularly concerning technique involves attackers attempting to steal authentication tokens rather than passwords. These tokens are generated during legitimate authentication sessions and are used to maintain authenticated access. In certain circumstances, stealing one of these tokens can allow an attacker to hijack an authenticated session without needing to complete MFA again.
I’ve investigated incidents where suspicious authentication activity appeared to originate from multiple geographic locations within a relatively short period. And by a short period, I mean literally seconds apart. Situations like that demonstrate why simply having a strong password is no longer sufficient.
Q: What are your recommendations for staying safe?
A: My recommendations are fairly straightforward. First, enable multifactor authentication on every account that supports it, particularly email, banking, and financial accounts. Whenever possible, use passkeys or phishing-resistant authentication methods rather than relying exclusively on text messages.
Second, never assume an email or text message is legitimate simply because it appears to come from someone you recognize. If something seems unusual, verify it independently and promptly. Don’t use the phone number or link provided in the suspicious message.
Third, use unique passwords for every account, preferably managed through a reputable password manager. Keep your devices updated and pay attention to unexpected authentication requests or security notifications.
Finally, I always emphasize that technology alone cannot eliminate the human element of cybersecurity. Attackers frequently target people rather than systems because manipulating someone into providing access is often easier than defeating the security controls protecting that access.
Q: In my situation, as you know, I basically lost access to my email account. How can the average user protect himself from a similar mess? How do you plan ahead so that you don’t fall into such a trap?
A: This is something I think people frequently overlook. Most individuals don’t consider how dependent they are on their primary email account until they lose access to it. Your email is effectively the gateway to your digital identity because it’s often used to recover passwords and authenticate access to other services.
In the vast majority of cases, your primary email account essentially holds “the keys to the castle.” If someone gains control of it, they may potentially gain access to numerous other accounts associated with your digital identity. Protect your castle.
My first recommendation is to establish multiple recovery methods before something happens. Configure a secondary recovery email address, verify your recovery phone number, enable MFA, and securely store your backup recovery codes somewhere outside your primary email account.
It’s equally important to periodically review your account’s security settings, including connected devices, recovery information, and recent login activity. Make sure you recognize everything associated with your account.
I’ve spent much of my career working in cybersecurity, including government contracting, the defense industry, and the banking sector. One thing I’ve consistently observed throughout that time is that recovering from a security incident is considerably more difficult than preventing one.
My advice is simple: Plan for the possibility that you could lose access tomorrow. Ask yourself whether you could recover your account without access to your current phone or primary email. If the answer is no, that’s something you should address today rather than after an incident occurs.
And remember, cybercrime is no longer just a handful of individuals sitting behind computers trying to steal passwords. It’s a massive, highly organized, multibillion-dollar global industry. With advancements in artificial intelligence, the technical barriers to entry are becoming increasingly lower, allowing even relatively inexperienced individuals to launch sophisticated attacks.
The threats will continue to evolve, but taking a few basic precautions today can significantly reduce your chances of becoming a victim tomorrow.
