Security Training
When a Link Asks for Permission Instead of a Password
What Is Happening
Most phishing goes after your password. This kind does not need it. The FBI calls it consent phishing and warned about it on September 1, 2026.
A message with a link, posing as a shared file or an event invitation, opens a genuine permission screen from your email provider. If you approve, the criminal behind that app can read and send your mail.
You granted the access yourself, so the app never needs your password or your sign-in code. The FBI notes that the access lasts until the app's permission is removed in the account's security settings. Changing your password does not end it.
Sources
- FBI IC3 PSA I-090126-PSA, September 1, 2026Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing
- Microsoft Learn, July 3, 2026Detect and Remediate Illicit Consent Grants in Microsoft 365
Want This for Your Whole Team?Ask us about security awareness training for your staff.
Ask About Awareness Training