What is consent phishing? How an app can read your account without your password

Most phishing advice assumes the attacker wants your password. Some attacks skip that entirely — and because they do, almost every defence people have been taught quietly fails.

Quick answer

Consent phishing is an attack that tricks you into approving an application's access to your account, rather than stealing your password.

You click a link, sign in normally on the real Google or Microsoft page, pass your own two-factor check — and then a permission screen asks whether an app called something plausible may read your mail. You press Allow.

Nothing was stolen. You granted it. And the access does not end when you change your password.

How it works

The system underneath is OAuth — the standard that lets you connect an app to an account without handing over your password. When you let a calendar app read your Google Calendar, that is OAuth doing its job properly. The provider issues the app a token granting specific permissions, and the app never sees your password.

Consent phishing abuses that flow.

1. A lure arrives — an email or message with a link. Often a shared document, an invoice, a meeting recording, a security alert.
2. You are sent to the real provider. Not a fake page. Genuine accounts.google.com or login.microsoftonline.com, with a valid certificate.
3. You sign in normally, including your second factor. All of it real.
4. A consent screen appears, hosted by the provider, listing an app's requested permissions. Microsoft's own description: "Because a legitimate provider (such as the Microsoft identity platform) hosts the application, unsuspecting users accept the terms."
5. You press Allow. The attacker's app receives a token.
6. The token keeps working. It is independent of your password and, if offline access was granted, it can be refreshed indefinitely.

What an attacker gets

It depends on what was granted, and the requests are usually broad:

• Read your mail — everything in the mailbox, including old messages
• Send mail as you — phishing your contacts from your genuine address, which passes every filter
• Read and write files in your cloud drive
• Read your contacts — a target list, with the relationships already mapped
• Offline access — a refresh token that keeps working while you are logged out

The mail-sending permission is the one that turns a single account into a campaign. A phishing message from a colleague's real address, in a real thread, does not look like phishing to anyone.

How to read a consent screen

The screen is genuine, so there is no visual tell. What you are checking is whether the request is reasonable.

1. Does the permission match the job?

A PDF viewer needs to open the file you gave it. It does not need to read your entire mailbox, send mail as you, or keep access when you are not using it. A mismatch between what an app claims to be and what it asks for is the single strongest signal.

2. Who is the publisher?

Microsoft's guidance is blunt: "Don't rely on application names and domain URLs as a source of authenticity." Anyone can name an app "Office365 Secure Document" and register a lookalike domain. Look for the verified-publisher marker, and treat an unverified publisher requesting broad permissions as a refusal.

3. Is this expected?

Did you go looking for this app? A consent prompt that arrives at the end of a link someone sent you is a prompt nobody asked for.

4. Is the language right?

Microsoft advises checking for poor spelling and grammar in the consent screen itself, and reporting suspicious apps through the "Report it here" link on the prompt.

How to check what already has access

Worth doing today, regardless of whether you think anything happened. Most people find several apps they no longer use.

Google: open your Google Account, go to Data & privacy, then Third-party apps & services — reachable at myaccount.google.com/connections. Each entry shows what it can access and offers a remove option.

Microsoft: open your account's privacy settings and review Apps and services that have access. Work and school accounts are managed by your organisation's administrator.

Apple: check Sign in with Apple under your Apple Account settings.

Everything else: most large services have an equivalent page under settings called connected apps, authorised applications, or permissions.

Remove anything you do not recognise, no longer use, or that has more access than it needs. Nothing is lost — a genuine app will simply ask again next time.

If you already approved something suspicious

Order matters, because the usual first instinct is the wrong one here.

1. Revoke the app first. This is what ends the access. Changing the password does not.
2. Then change your password and sign out of all sessions on the account.
3. Check what it changed. Look for mail forwarding rules, new filters that delete or archive incoming messages, added recovery email addresses or phone numbers, and new signature blocks. These are the persistence tricks — they keep working after the app is gone.
4. Check your sent folder for messages you did not write, and warn anyone who received them.
5. Review linked accounts. Anything that uses that email address for password resets may also have been touched.
6. If it is a work account, tell your IT team immediately. They can audit the grant across the organisation, and Microsoft publishes specific guidance for detecting and remediating illicit consent grants.
7. Report it — through the "Report it here" link on the Microsoft consent prompt, and to your national reporting body. How to report an online scam covers where.

I gave a scammer my password covers the adjacent case, where a credential was actually handed over.

How this fits with other phishing

It is the same social engineering with a different capture step. How phishing works breaks an attack into five stages, and consent phishing changes only stage four: instead of capturing a credential, it captures an authorisation.

That is why the defences differ. The four checks that identify a phishing email still catch the lure that carries you into it — the unexpected shared document, the invoice you were not expecting. Once you are on the consent screen, the only remaining check is reading the permissions.

Key takeaways

• Consent phishing gets access by having you approve an app, not by stealing a password.
• The sign-in page and the consent screen are both genuine, so URL checks find nothing.
• Two-factor authentication does not prevent it, and a password change does not undo it.
• Judge the request, not the app's name — permissions that exceed the app's stated job are the tell.
• Revoking the app in your account's connected apps list is what actually ends the access.
• Audit connected apps periodically, and remove anything you no longer use.