Friday Blotter

Welcome back to the Friday Blotter — your weekly roundup of the scams making the rounds right now, written in plain English so you know exactly what to watch for. This week we’ve got three alerts straight from the Federal Trade Commission, and honestly, all three of them are sneaky in ways that could catch even careful people off guard. We’re talking about a fake CAPTCHA that secretly installs malware on your device, a scammer pretending to be an FTC agent who promises to get your money back, and fake party invitations designed to steal your email password. Let’s dig in.

Scam #1: That CAPTCHA Might Be a Trap

What Is a CAPTCHA, and Why Should You Care?

Before we get into the scam, let me explain what a CAPTCHA actually is — because that’s the whole reason this trick works. You’ve seen them a thousand times. You’re on a website and a little box pops up asking you to click on all the traffic lights in a grid of photos, or type in some squiggly letters and numbers. That’s a CAPTCHA. It’s a quick test websites use to make sure you’re a real human and not an automated bot. Totally normal. Totally harmless — when it’s real.

Here’s the thing: scammers have figured out how to make fake CAPTCHAs that look absolutely identical to the real ones. And the FTC is now warning people about exactly this.

What Happened

The FTC issued an alert on June 8, 2026, warning consumers about a new phishing scam using fake CAPTCHA popups. These fake CAPTCHAs are showing up on websites — sometimes legitimate sites that have been compromised, sometimes fake sites set up by scammers — and they’re designed to trick you into installing malware on your own computer without even realizing it.

How the Scam Works

This is where scammers get people — and it’s genuinely clever. You’re browsing a website and a CAPTCHA pops up asking you to verify you’re human. So far, nothing unusual. But instead of asking you to click on fire hydrants or type some letters, this fake CAPTCHA tells you to follow a series of keyboard commands — something like pressing Windows + R, then Ctrl + V, and then Enter.

The screen might say something like “security verification” to make it sound official. But what’s actually happening behind the scenes is this: the fake CAPTCHA has already quietly copied a malicious command to your clipboard. When you follow those keyboard steps, you’re pasting and running that hidden command on your own device. You’ve just installed malware — and you did it yourself, which is exactly what the scammer wanted.

Once that malware is on your device, scammers can steal your email login, your mobile banking credentials, and any other sensitive information they can get their hands on.

Why People Fall for It

We’re all so used to seeing CAPTCHAs that we just… do them. It’s muscle memory at this point. Nobody stops to question whether a CAPTCHA is real because we’ve never had to before. Scammers are counting on that habit. They’ve made these fake ones look so much like the real thing that your brain doesn’t send up any alarm bells.

Source: FTC Consumer Alert, June 8, 2026 — How to spot a CAPTCHA scam

---

Scam #2: The Fake FTC Agent Who Wants to “Help” You Get Your Money Back

A Cruel Twist on an Already Painful Situation

Let’s talk about one of the most heartless scams I’ve seen in a while. This one specifically targets people who have already been scammed once. Think about that for a second. You’ve already lost money to a fraud. You’re upset, maybe embarrassed, and you really want to get that money back. And then someone contacts you claiming they’re from the FTC and they can help you recover your losses. It sounds like a lifeline.

It’s not. It’s another scam.

What Happened

The FTC issued an alert on June 3, 2026, warning about scammers who are impersonating FTC employees and falsely claiming they can help victims recover money lost in previous scams. This is what’s known as a “refund and recovery scam” — and it’s a double hit on people who are already hurting.

How the Scam Works

If someone contacts you and says they’re an FTC “agent” who can recover your lost money, here’s what’s actually happening:

• You receive an unexpected message from someone you don’t know
• They claim to be an FTC employee or “agent” — they are not
• They say they can help you “recover losses” from a previous scam — they cannot
• To gain your trust, they send you what looks like a photo of an official employee ID and a badge — both are completely fake
• Once they’ve earned your trust, they ask for money, access to your financial accounts, or your personal information

This is where scammers get people — they know that someone who has already been scammed is desperate to get their money back. That desperation makes people more willing to trust someone who seems official and offers hope.

Why People Fall for It

The fake ID and badge are a big part of why this works. When someone sends you what looks like official government credentials, it feels legitimate. Most of us have never seen a real FTC employee ID, so we have no way to know it’s fake. Add in the emotional weight of wanting to recover lost money, and it’s a very effective trap.

Here’s the thing: the FTC does not contact people this way. Ever.

Source: FTC Consumer Alert, June 3, 2026 — A real FTC employee won’t text you their photo ID to “verify” their identity

---

Scam #3: That Party Invitation Could Steal Your Password

It’s Party Season — and Scammers Know It

Graduation parties. Summer cookouts. Birthday celebrations. This time of year, our inboxes fill up with invitations, and most of us are happy to see them. Scammers know that too, and they’re taking full advantage of it.

The FTC issued a warning on May 26, 2026, about a phishing campaign using fake party invitations that look like they’re from well-known platforms like Evite or Paperless Post. These fake invites are designed to steal your email login credentials — and once scammers have those, they can do a lot of damage.

How the Scam Works

You get an unexpected text or email. It looks like a party invitation — maybe for a graduation, a birthday, or a summer get-together. It might even list someone you actually know as the host, which makes it feel completely real.

But when you try to open the invitation, something odd happens. Instead of just showing you the event details, it asks you to:

• Enter your email address and password to “view” the invitation, or
• Enter your phone number and share a special code to RSVP

That is not how real invitations work. Evite and Paperless Post do not ask for your email password to open an invitation. What’s actually happening is that a scammer is trying to steal your login credentials. If they get your email username and password, they can take over your entire email account — and then use it to send the same scam to everyone in your contacts list.

Why People Fall for It

Red flag number one is easy to miss because the invitation looks so legitimate. These scammers do their homework. They mimic the design of real invitation platforms, they sometimes use the name of someone you know as the “host,” and they catch you at a time of year when you’re genuinely expecting invitations to arrive. Your guard is down because the timing makes sense.

The request to “log in to view” also sounds plausible to a lot of people. We log into things all the time. It doesn’t immediately seem strange — until you stop and think about it.

Source: FTC Consumer Alert, May 26, 2026 — Asked to enter your email address and password to open a party invite? That’s a scam

---

What To Do Next

All three of this week’s Friday Blotter scams have one thing in common: they use something familiar to catch you off guard. A routine CAPTCHA. An official-looking government agent. A friendly party invitation. The scammers are counting on you to react on autopilot — to just do the thing that seems normal without stopping to think.

So here are the action steps I’d encourage you to take right now, before you need them:

1. Turn on two-factor authentication on your email account and any financial accounts. This is the single best thing you can do to protect yourself from password theft.
2. Keep your security software updated on your computer and your phone. Updated software catches threats that older versions miss.
3. Bookmark ReportFraud.ftc.gov. If you encounter any of these scams, reporting them helps the FTC track patterns and warn others.
4. Share this article with someone you care about — especially anyone who might be less familiar with how these scams work. The more people who know, the harder it is for scammers to succeed.

---

Final Thoughts

I want to leave you with something that I think is really important. None of the people who fall for these scams are foolish. These are well-designed traps built by people who study human behavior and know exactly which buttons to push. The fake CAPTCHA works because we’re trained to complete CAPTCHAs without thinking. The fake FTC agent works because we want to believe someone is on our side. The fake party invitation works because it arrives at exactly the right time of year.

Awareness is your best defense. When you know what to look for, you can pause before you act — and that pause is everything. A few seconds of “wait, does this make sense?” can protect your accounts, your money, and your personal information.

Stay sharp out there, and I’ll see you back here next Friday.

— Nancy Hardman, Blotter Vault