Consent phishing: access that a password change does not revoke
In September 2026 the FBI warned about OAuth consent phishing — a technique that obtains lasting access to an account without ever taking a password. The victim is sent a link that asks them to approve an application, and the resulting token cannot be cancelled by changing the password. Since late 2025 the FBI has observed actors impersonating government officials, media figures and event organisers on messaging apps to deliver these requests.
- Year
- 2026
- Where
- United States
- Outcome
- Ongoing
- Victims
- Not stated in the sources
- Schemes
- Phishing and smishing, Business email compromise, SIM swap, QR code scams
- Last reviewed
- 2026-09-06
The facts, as recorded
- IC3 advisory issued 1 September 2026, describing activity observed since late 2025.
- OAuth is the standard framework that lets one application request access to your account on another without seeing your password.
- Consent phishing obtains a permission token rather than credentials, so no password is exposed.
- The FBI notes access 'can only be revoked by the victim invalidating the token in their application security settings; not by changing the password'.
- Observed lures include impersonating government officials, media and public personalities on commercial messaging applications with a file-sharing link.
- Earlier campaigns impersonated event coordinators, sending links framed as an invitation requiring identity verification.
- Targets include prominent individuals, their family members and personal acquaintances.
Why this case matters
Almost every piece of advice given to phishing victims is some version of “change your password”. This technique is specifically designed to make that irrelevant.
Consent phishing does not ask for a password at all. It asks you to grant an application permission — the same screen you have clicked through legitimately dozens of times when connecting a calendar tool or a document viewer. The permission produces a token, and, in the FBI’s own words, that access “can only be revoked by the victim invalidating the token in their application security settings; not by changing the password.”
Why the usual signals do not fire
There is no fake login page, so the phishing advice about checking the URL bar does not apply. There is no credential to steal, so a password manager’s refusal to autofill — usually an excellent tell — never happens. Multi-factor authentication does not help either, because nothing is being logged into.
What the victim sees is a real permission dialogue, served by their real provider, listing an application with a plausible name.
What to do differently
The practical countermeasure is a habit almost nobody has: audit your connected applications. Every major provider has a security page listing which third-party apps hold access to your account. Most people have never opened it, and most people would not recognise half of what is on it.
Do that periodically, and revoke anything you do not actively use. If you have clicked a suspicious link, revoking there matters more than changing your password.
What it tells you about the scheme
The target profile is worth noting: prominent individuals and their family members and personal acquaintances. Attackers reach a hard target through softer people around them, which is the same logic that makes a supplier’s mailbox the route into a well-defended company in business email compromise.
Sources
- Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing. FBI Internet Crime Complaint Center. Accessed 2026-09-06. Supports: Every detail above: the technique, the persistence of access, the observed lures and the target profile.