OAuth lets a user grant an application limited access to an account without sharing a password. The design suits calendars, storage and mail clients. It is also abused. In consent phishing, an attacker registers an application with a plausible name, then sends a link that opens a real identity provider's consent screen. The victim is asked to approve scopes such as reading mail, sending mail or keeping access while offline. Once approved, the app receives a token. No password is typed into a fake page, so multi-factor authentication does not stop the grant, and the account may look normal afterwards.
What the request looks like
The consent screen itself is genuine. The address belongs to the identity provider, and the sign-in step may be fully legitimate. The signals are in the content: an application name such as "Document Viewer", "Secure Mail Sync" or "Voicemail Player"; a publisher that is unverified or missing; and a permission list far larger than the stated purpose needs. Scopes that deserve close attention include full mailbox read or write, the ability to send as the user, access to contacts and calendars, and offline access, which lets the app keep a refresh token that survives a password change.
The lure usually arrives as a file-share notification, a "review this invoice" message, or a request from a colleague whose account is already compromised. A familiar sender does not make the link safe.
Before approving anything
- Check the requested scopes, not just the app name. A calendar tool that asks to read mail is a mismatch.
- Check the publisher. A verified publisher is not a guarantee, but missing publisher information is a reason to stop.
- Do not approve a consent screen you reached from a link in an unexpected message. Open the service yourself and find the integration from its settings page.
- For organization-wide grants, route the request to an administrator rather than approving it as an individual employee.
Reviewing granted access
Most identity providers list the applications that hold access to an account. Review that list regularly and after any suspected compromise.
- Google accounts: open the third-party access page in the account's security settings and review each entry. Remove anything unfamiliar or no longer used.
- Microsoft accounts and work accounts: review app access in the account's security or app permissions area. Administrators can review enterprise applications and their consented permissions in the identity administration console.
- Other providers: look for "connected apps", "authorized applications" or "third-party access" in the security settings.
Revoking an app invalidates its tokens, which is the step that matters. Removing an account from a mail client on your own device only deletes local state. The grant stays active on the provider side until it is revoked there.
Mail access on ITProMail
ITProMail mail clients connect with app passwords rather than third-party OAuth grants, so the review on ITProMail centers on two areas of the account menu. Under Account > Security, review active sessions and revoke any you do not recognize. Then review the app password list and delete entries you no longer use. Each app password is a separate credential, so deleting one does not affect the others or your login password. The app passwords guide explains how to create and revoke them, and the TOTP and FIDO2 guides cover second factors.
After a suspected grant
- Revoke the application from the provider's access page.
- Change the account password and sign out other sessions.
- Review forwarding rules, filters and delegated access. An application with mail access may have created rules that hide its activity.
- Check sent mail for messages you did not write, especially copies of the lure sent to colleagues.
- Report the application and the original message to the provider and to your organization's security contact.
Keeping the risk low
Grant the narrowest scope that works, and revoke access when a tool is retired. Teams benefit from a short list of approved applications and a review step before any new grant that reads mail. Multi-factor authentication protects sign-in, not a grant that has already been approved, so it should be paired with these reviews rather than relied on alone. The wider set of lures that lead to consent requests is covered in spotting modern phishing.