Fake Party Invites and the Rise of Social Phishing Attacks

A new wave of phishing attacks is exploiting personal connections through fake party invites from services like Evite and Paperless Post, preying on curiosity and FOMO. But the real story isn’t the novelty of the scam—it’s how deeply entrenched the problem is in flawed system design. Hosts Kevin Tackett and Chase argue that these attacks aren’t new, and the real failure isn’t user ignorance, but the tech industry’s persistent reliance on link-clicking as a core interaction. They call out companies like PayPal and Chase for sending phishing-like emails that force users to click dangerous links, even when they’re aware of the risks. The solution? Stop building systems that depend on users clicking random links. Instead, design for safety: make the main site the default, use code-based verification, and prioritize secure-by-design principles. AI may be helping attackers craft better messages, but the core vulnerability remains human psychology—and flawed architecture. The episode ends with a reminder: the most dangerous security flaws aren’t in code, but in the assumptions we make about how people behave.