On September 1, 2026, the FBI issued a public service announcement about a scam that doesn’t need your password. It’s called consent phishing. Most of the teams we work with know the basics by now: protect your password and turn on multi-factor authentication (MFA). Those habits still matter, and our MFA guide for small business explains why. This attack simply walks around both of them, because it uses a real Microsoft or Google login page and asks you to click one button: “Allow.”
What is consent phishing?
Most phishing tries to trick you into typing your password into a fake website. Consent phishing doesn’t bother with a fake site. Instead, it asks you to give an app permission to use your account.
That permission system is real, and you’ve almost certainly used it. It’s called OAuth, the standard that lets one app connect to your Microsoft or Google account without ever seeing your password. It’s what happens when you let a scheduling tool read your calendar or a file-sharing service open your documents. In everyday use, it’s a convenience. In the wrong hands, it’s a front door with the key already in it.
According to the FBI, attackers have been using this technique since late 2025 against prominent people, along with their family members and personal contacts. The scammers pose as government officials, members of the media, and event planners. The FBI’s examples involve high-profile targets, but we want to be clear: nothing about this technique is limited to famous people. It works on any Microsoft or Google account, and that includes the one your front desk opens every morning.
How consent phishing works, step by step
It starts on the attacker’s side, before anyone at your office hears from them. They register an app with a legitimate login provider and give it a harmless name, something that sounds like a file storage or identity verification service. Then they set it up to request wide access, including the ability to read and send email and open files.
Next comes the message. It might arrive by email or through a messaging app, and it usually comes from someone who seems credible. A reporter wants your thoughts on a draft article. An organizer needs you to confirm your spot at an event. An official has a document to share. There’s a link, and it looks routine.
Here’s the part that makes this so convincing. When you click, you land on a genuine Microsoft or Google sign-in page. You sign in the way you always do, and your password goes only to Microsoft or Google, never to the attacker. Then a permission window pops up asking you to approve the app. One click on “Allow,” and the attacker’s app can act as you, including reading and sending your email and getting into sensitive data. Because every screen along the way was real, nothing feels wrong.
Why MFA and a new password won’t undo it
This is the piece we most want business owners to hear. When someone realizes they clicked something they shouldn’t have, the natural reaction is to change the password. With consent phishing, that doesn’t solve the problem.
The FBI explains that once you approve the app, its access is persistent. The app holds a token, which works like a standing pass, and that pass keeps working after a password change. MFA doesn’t help either, because you completed MFA yourself when you signed in. The only way to end the access is to remove the app from the account’s security settings.
That’s why we would always rather hear from you too early than too late. Trust your gut: if something feels off after you’ve clicked, it probably is, and that feeling is worth a phone call.
What one quiet mailbox means for your business
Think about what lives in a single business inbox. Client conversations. Invoices and payment details. Banking information. Contracts and vendor conversations. An attacker with quiet access to that mailbox can read all of it without setting off a single alarm.
And they can do more than read. Because they can send email as that person, their next message comes from a real company address, with a real signature and a real history behind it. A request to update banking details or pay an invoice is far more believable when it comes from someone your clients and vendors already know and trust.
How your team can spot consent phishing
Here’s something that might surprise you: one of the most frequent calls our team gets is a client asking us to take a second look at an email they aren’t sure about. We love those calls. Every one of them is a moment where someone paused, trusted their instincts, and asked before clicking. That pause is exactly what stops consent phishing, and we want everyone on your team to feel comfortable making it.
- Pause on unexpected links. Be cautious with links from people you don’t know, even when they say they’re a reporter, an official, or an event organizer.
- Verify through a separate channel. Before you open a shared file or accept an invitation, confirm the sender another way, like calling a number you already have. Don’t rely on the contact details in the message itself. And when in doubt, just ask us. Forward it over and we’ll take a look.
- Read the permission screen. If a window asks you to let an app access your email, files, or account, read it slowly. If you don’t recognize the app or aren’t sure why it needs that access, click “Cancel.”
- Only approve apps you trust. The safest apps are the ones your IT provider has already reviewed and approved. If you’re not sure whether an app is on that list, ask before you click.
- If you clicked “Allow,” call your IT provider right away. Changing your password won’t remove the app’s access, so don’t stop there. Keep screenshots of the messages you received, and report the incident to the FBI at ic3.gov.
For business owners: questions to ask your IT team
Staff awareness is the first layer. The second is how your accounts are set up. Microsoft 365 and Google Workspace both include settings that control which third-party apps can connect to company accounts and who’s allowed to approve them. This is our recommendation rather than part of the FBI’s guidance, and it’s one we feel strongly about: instead of every employee deciding alone what gets access to company email, the decision runs through someone who knows what to look for.
A few questions worth bringing to your IT team:
- Who in our company can approve a third-party app’s access to email or files right now? Is it everyone, or a short list?
- Which apps currently have access to our Microsoft 365 or Google Workspace accounts, and do we still use all of them?
- If an employee approved a suspicious app, how would we find out, and how quickly could you remove it?
- When did anyone last review our connected apps? If nobody can remember, it’s probably time.
The takeaway
Consent phishing works because it borrows trust from tools you use every day. The login page is real. The permission window is real. The only thing that isn’t real is the app asking for access. That can sound unsettling, but the defense is refreshingly simple: slow down, verify the sender, read before you click “Allow,” and pick up the phone if something feels off.
You don’t need to be a security expert to protect your business. You need a team that knows when to pause and a partner who answers when they call. As Oscar puts it, “I wouldn’t do anything for someone that I wouldn’t do for myself.” That’s how Angie, Oscar, and our whole team look after the accounts we support: the same way we look after our own.
As always, your Paradigm team is just a call, email, or text away for any questions or concerns that may arise.
If you’d like us to review which apps currently have access to your company’s accounts and remove anything you don’t recognize or no longer need, we’re here to help. Give us a call at 321-248-3954 or email info@paradigmitgroup.net. No pressure, no sales pitch. Just an honest conversation about where you stand.
Your Paradigm Team
