You Did Not Give Them Your Password. You Gave Their App Permission.

A message asks you to review a shared document, confirm an invitation, or verify your identity for an event.

You click. The sign-in page is familiar and may genuinely belong to Google, Microsoft, or another trusted account provider. After signing in, a screen asks whether an app may read your email, access files, view contacts, or act on your behalf.

You select Allow.

The scammer may never see your password. They may not need it.

The FBI calls this technique OAuth consent phishing. Instead of stealing login credentials, a malicious application asks the account provider for permission to access parts of your account. If the user approves, the app receives an authorization token that can allow continuing access to email, files, and other data.

This matters because the login page can be legitimate while the application requesting access is not.

Why this works

We have learned to look for fake sign-in pages. Consent phishing uses a different trust signal: the real sign-in page.

The message may appear to come from a journalist, event organizer, government official, colleague, school contact, or someone sharing a file. The app can have a reassuring name such as “Secure Documents,” “Identity Verification,” or “Cloud File Viewer.”

After signing in, the permission request may feel like ordinary setup language. Many of us have clicked Allow while connecting calendars, photo services, games, productivity tools, or social accounts. The scam hides a consequential decision inside a familiar routine.

Multi-factor authentication may not stop this particular action because the user is successfully signing in and approving the access. The account provider sees an authorized request, not necessarily a stolen password.

Read the permission screen as a contract

Before approving any connected app, stop and ask:

• Did I expect this request?
• Do I know and trust the company that created this app?
• Why does a document viewer need to read or send my email?
• Why does an event invitation need access to all my files or contacts?
• Can I complete the task through the sender's established website instead?
• Have I verified the sender through another communication method?

Permission requests should match the job the app claims to perform. A weather app needing your approximate location may make sense. A simple PDF viewer requesting the ability to read, delete, or send email does not.

Do not rely only on the app's name or logo. Those can be chosen to resemble a legitimate service.

The deny-and-verify rule

For unexpected account-permission requests:

1. Choose Cancel or Deny. You can reconsider after verification.
2. Leave the message. Do not reply through the same account or use another link it supplies.
3. Contact the sender independently. Use a phone number, email address, or account you already know.
4. Open the service directly. Type the known website or use the official app rather than returning through the message.
5. Review the exact permissions. If the requested access is broader than the task, do not approve it.

A legitimate sender can explain the request and provide another way to share a document. Urgency is not a reason to grant access to an unfamiliar application.

If you already clicked Allow

Do not assume a password change removed the access. The FBI warns that an authorization token can remain valid after a password is changed.

Go directly to the account provider's security settings and review third-party apps, connected applications, and account permissions. Remove anything unfamiliar or unnecessary. The labels and steps vary by provider, so use the provider's official help pages rather than instructions from the original message.

Then review recent account activity, connected devices, email forwarding rules, recovery information, sent messages, and deleted items. Change the password if there is any chance it was exposed, use a strong unique replacement, and keep multi-factor authentication enabled.

If the account belongs to an employer, school, campaign, or organization, contact its security or IT team immediately. Preserve screenshots of the message, app name, permission screen, sender, and link. Report the incident to the FBI Internet Crime Complaint Center at IC3.gov when appropriate.

Warn contacts if the compromised account may have sent them messages. A malicious app with email access can use a trusted account to continue the scam.

Talk about it tonight

Ask your family: “When a familiar sign-in page asks an unfamiliar app for permission, what do we check before pressing Allow?”

Agree on the answer: deny first, verify the sender separately, and make sure every requested permission fits the task.

If the original message feels suspicious, use The Scam Hotline Scam Detector to examine its pressure tactics. Do not paste passwords, authorization codes, private links, personal documents, account details, or other sensitive information into any online tool.

Sources

• FBI IC3: Malicious Cyber Actors Gain Access Through Consent Phishing
• CISA: Avoid Phishing Scams With Three Simple Tips