FBI Warns of OAuth Consent Phishing: The "Allow" Button That Survives a Password Reset
On 1 September 2026 the FBI published a warning about a phishing technique that gets around most of the advice people know. The login page is real, the password is never stolen, and changing the password afterwards doesn't lock the attacker out.
The FBI's Internet Crime Complaint Center (IC3) issued public service announcement I-090126-PSA about "OAuth consent phishing". The FBI says the activity dates back to late 2025. It targets prominent people and, notably, their family members and personal acquaintances, through direct messages on commercial messaging apps. The messages come from people posing as journalists, officials and event coordinators.
How consent phishing works
OAuth is the "Sign in with Google / Microsoft" system that lets one app get access to your account in another without seeing your password. Consent phishing turns that feature against you:
- The app: the attacker registers an app with a real OAuth provider and asks for broad permissions, such as reading and sending mail or reading files.
- The lure: a message invites you to view a document, verify your identity or join an event.
- The real login: you land on the genuine Google or Microsoft sign-in page. Your password goes to Google or Microsoft, not to the attacker.
- The prompt: a permission screen asks you to let the app access your account. You click Allow.
- The access: the attacker's app now has an access token and can read your email and files through the provider's own API.
In the FBI's words, once permission is granted the access "can only be revoked by the victim invalidating the token in their application security settings; not by changing the password."
Why the usual advice doesn't help
"Check the address bar" doesn't help here, because the sign-in page is real. "Use MFA" doesn't either, because you completed MFA yourself. The attack succeeds at the consent screen, which most people click through without reading. That's why the FBI recommends approving only apps you already trust and checking who the sender really is through a separate channel before opening links from people you don't know.
Read the consent screen before you click Allow
- Who is asking? The screen names the app and usually its publisher. An unfamiliar name attached to a "document viewer" or "verification" request is a warning sign.
- What is it asking for? Viewing a shared file doesn't need permission to read, send and delete all your email.
- Did you go looking for this app? If a message you didn't expect sent you here, close the tab.
How to check and revoke app access now
Every major provider lists the third-party apps that have access to your account. In a Google account it's under Security → Your connections to third-party apps & services. In a Microsoft account, look in the privacy or security settings for the apps and services you've given access to; work accounts show this on the My Apps / My Account page. Remove anything you don't recognise, and check the list again after any suspicious message. For organisations, the stronger fix is administrative: stop users from consenting to unverified apps and route new app requests through an admin approval process.
Where the browser fits in
Consent phishing is hard for any tool to catch, because nearly every page in the chain is legitimate. What a browser tool can do is catch the pages that aren't: the fake "shared document" landing page, the redirect through a lookalike domain, or a login form that sends your password somewhere unexpected. PhishClean checks those locally on every page. The consent screen still needs you to read it.
Sources
Catch the fake pages around the real one
PhishClean flags lookalike domains, fake document lures and login forms that post your password somewhere unexpected.
Install PhishClean FreeLast updated: