Is it from Paperless Post or a phishing scam? How to spot the difference

At Paperless Post, we value our users’ privacy and security greatly. Recently, there has been a reported rise in phishing scams that impersonate online invitation platforms, such as ours. These fraudulent emails can look convincing, so it’s important to know how to spot a scam versus the real thing. 

These phishing scam attempts are created and distributed completely outside of our platform, but they are easy to spot if you know what to look for. Here’s everything you need to know.

What is phishing?

Phishing is a type of cyberattack where a scammer sends a fake message (often via email or text) designed to trick you into sharing sensitive personal data or login information. These messages are often sent from what appears to be a trusted source, such as a company or the email address of someone you know. If you look closer, however, you can tell that something is off.

How to spot a phishing scam email

While phishing scam emails may mimic the overall look and feel of a Paperless Post invitation email, there are several characteristics to look out for to confirm a real Paperless Post invitation’s legitimacy.   

Here’s how you identify a legitimate Paperless Post invitation:

• A real Paperless Post URL: A real Paperless Post invitation link will begin with https://paperlesspost.com, https://links.paperlesspost.com, or https://pp.events/. An invitation that is hosted on any other URL is illegitimate.

• No login or download required: You will never have to log in to an account just to view or RSVP to a Paperless Post invitation. It will open directly, and no extra steps are required.
  

• No attachments: A Paperless Post invitation will never contain an attachment or downloadable file (.exe, .pdf, .msi, etc.), only embedded images.
  

• Check the sender or link: Paperless Post emails will come from an official “@paperlesspost.com” address. Invitations delivered via text will come from our verified business profile.
  
• Even if you recognize the sender, double-check everything: Even if a message was sent from your friend’s email address, they could have been hacked. Make sure you check all of the above, including that the URL links to paperlesspost.com, and there is no download or login required. If any of these things seem off, forward it to phishing@paperlesspost.com, and we will confirm if it’s a scam.

Pro tip: Some email providers (like Gmail, Apple Mail, and Yahoo) display a blue check mark for verified senders. Seeing this next to Paperless Post helps confirm it’s really us.

What to do if you receive a phishing email

If you receive an email or text message that doesn’t match the above qualifications, you should assume it’s a scam and proceed accordingly. Here’s what to do if you suspect you may have received a phishing scam message. 

• Most importantly, don’t click on any links or download any files. 
• Forward the message to phishing@paperlesspost.com so our team can investigate and follow up. If we confirm it is fraudulent, we will report the phishing link to our anti-phishing partners. 

Think someone sent an invitation “from you” that you didn’t create?

Here’s what to do if someone lets you know that they received a Paperless Post invitation that claims to be from you, but you didn’t send it. 

• Immediately change your email account password and set up two-factor authentication. 
• Run an anti-virus scan or visit an IT professional to ensure there’s no malicious software installed on your computer. 
• Reach out to phishing@paperlesspost.com if you suspect your Paperless Post account was compromised. 

FAQs

Is Paperless Post secure?

Yes, these scams are not the result of any breach of our systems. Paperless Post remains completely safe, secure, and private. Invitations sent through our platform are never intercepted or altered by third parties. These scams are outside attempts to imitate us and other invitation platforms. 

How often are these phishing scams happening?

We noticed an uptick in reports starting around the end of 2025, but the number of reported scams is still very small compared to the volume of legitimate invitations sent through our platform every day. 

What is Paperless Post doing to combat phishing scams?

In addition to educating users and creating a dedicated reporting address (phishing@paperlesspost.com), we have partnered with the Anti-Phishing Working Group (APWG), a global nonprofit coalition that combats online scams, such as phishing attacks. 

The APWG acts as a shared intelligence network and database where members can share any malicious links or scam campaigns, which APWG then aggregates and distributes widely to help companies detect and block threats as soon as possible.

Stay informed and secure with Paperless Post

The security of our users is our priority. We are a trusted, secure, and private platform, sending millions of invitations every week for all of the most important events in people’s lives. Despite these unfortunate phishing attempts, this is an opportunity for users to educate themselves on how to spot a fake, so that they can feel confident and empowered. Stay informed, stay safe, and stay celebrating.