FBI: "consent phishing" can let attackers into your email without your password

On September 1, 2026, the FBI warned that malicious cyber actors are breaking into accounts with a technique known as "OAuth consent phishing". Since late 2025, according to the alert, they have sent direct messages with malicious links to the personal accounts of prominent people and of their relatives and acquaintances. The twist is that the victim never gives away a password. They grant the access themselves.

What the FBI is warning about

OAuth is a common authorization framework. It lets a website or web application ask for access to your account on another service without you handing that site your login credentials. Google's help pages, for example, say apps from other developers may request access to Gmail, Drive, Calendar, Photos or Contacts. Consent phishing abuses that same mechanism.

In recent cases, the FBI says, the attackers posed as government officials, members of the media and other public figures on a commercial messaging app. They asked the target to open a link presented as a file-sharing service that actually ran through an app the attackers controlled. Earlier campaigns impersonated event coordinators and planners: the target received an invitation to an event and was told to verify their identity through a malicious app.

How consent phishing works

Traditional spear phishing, the FBI notes, relied on links to credential-harvesting sites or on malware. Consent phishing works differently:

1. It usually begins with a phishing email or a direct message on a messaging app.
2. The link sends you to a real permission request screen from a legitimate communication provider.
3. If you approve the request, you unknowingly give high-level access to an app the attacker controls.
4. From then on, the attacker can act as you, including reading and sending your email and getting into sensitive data, without ever having your credentials.

Because the attackers register their apps through legitimate authorization protocols and rely on social engineering, the FBI says they can get around both passwords and multi-factor authentication. The access also lasts. Once permission is granted, the FBI says, it can be revoked only by invalidating the app's token in the account's security settings. Changing the password won't do it.

How to spot a risky request

• Be extra careful with messages from unfamiliar phone numbers or accounts, or from anyone outside your known contacts. That is the first precaution the FBI lists.
• Confirm the sender on your own. The FBI advises verifying the sender's identity independently.
• Be wary when a shared file or an event invitation asks you to approve an app's access to your account. Both lures appear in the FBI's alert.
• Read the permission screen, not just the logo. Google advises reviewing an access request carefully to see what information and permissions the app wants, and granting access only to apps you trust. An app allowed to manage your data can edit, create and delete data in your Google Account.
• Never type your Google password into a third-party app. Google says that gives the app full access to your account.

How to remove an app you approved

Since a new password won't shut the app out, remove its access directly. These steps come from Google's and Microsoft's own help pages.

Google Account

1. Go to your Google Account's linked apps page at myaccount.google.com/linkedapps.
2. Select "Access to your Google Account", choose the app you want to review, then select "See details".
3. Review what the app can access. To cut it off, select "Remove access" and confirm.

Google says that after you revoke access the app can't reach your data anymore, but you may need to ask the developer to delete data it already has. If you think an app misused your data, the details page has a "Report this app" option.

Microsoft account

For a Microsoft work or school account, hover over the app in the My Apps portal, select the three dots, then "Manage your application", and use "Revoke Permissions" for anything you approved. You can't revoke permissions an administrator granted on your behalf.

Then check for signs of misuse

The FTC's checklist for a hacked email account is a useful follow-up: delete any forwarding rules you didn't create, look through your sent and deleted folders for messages the intruder sent or read, make sure the recovery email addresses and phone numbers are yours, and tell your contacts not to click links in messages that seem to come from you. The FTC also recommends a new, strong password and two-factor authentication after a hack. Per the FBI, a new password won't revoke an app you already approved, so revoke the app first.

Where to report

If you believe you've fallen victim, the FBI asks you to contact your relevant security officials and to report the incident to your local FBI field office or to the Internet Crime Complaint Center at ic3.gov. Include what information the attackers obtained, and keep screenshots of the messages.

A real permission screen can still hand your inbox to a stranger. Before you click Allow, know who is asking. If you already did, revoke the app: a new password won't.