What are the red flags of this scam?

An unsolicited DM from someone impersonating a public figure, government contact, or journalist asks you to open a file link • The link leads to a standard Google or Microsoft OAuth consent screen asking permission to read your email or files • You cannot explain why an unfamiliar app appears in your authorized applications list • Contacts report receiving file-sharing requests from your account that you did not initiate • You see sent emails you do not recall writing, or calendar events you did not create • Changing your password does not stop the unusual activity — because no password was stolen

What should I do if this happened to me?

Go to myaccount.google.com → Security → Third-party apps with account access and revoke any app you did not intentionally authorize • For Microsoft: visit myapps.microsoft.com and remove unfamiliar app authorizations • Before clicking Allow on any OAuth consent screen, read the list of permissions carefully — legitimate file-sharing services do not need permission to send emails or delete files • Treat any unsolicited file-sharing DM — even from a known name — with the same skepticism as an email attachment from a stranger • After revoking the rogue app, review your Sent folder and any shared documents for activity you did not initiate • Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

HIGH phishing Last reported: Oct 26, 2026 Share

"Click this file link" message grants a stranger permanent access to your email — without your password

Q: Is this a scam?

Yes. This is a documented scam pattern. A DM impersonating a journalist, official, or known contact sends a "file-sharing link." Clicking opens a real OAuth consent screen. Clicking Allow grants the attacker read/write access to your email and files — access that survives a password change and MFA reset.

A DM impersonating a journalist, official, or known contact sends a "file-sharing link." Clicking opens a real OAuth consent screen. Clicking Allow grants the attacker read/write access to your email and files — access that survives a password change and MFA reset.

Also known as: OAuth consent phishing, app permission phishing, consent phishing attack, malicious OAuth grant

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Go to myaccount.google.com → Security → Third-party apps with account access and revoke any app you did not intentionally authorize
2 For Microsoft: visit myapps.microsoft.com and remove unfamiliar app authorizations
3 Before clicking Allow on any OAuth consent screen, read the list of permissions carefully — legitimate file-sharing services do not need permission to send emails or delete files
4 Treat any unsolicited file-sharing DM — even from a known name — with the same skepticism as an email attachment from a stranger
5 After revoking the rogue app, review your Sent folder and any shared documents for activity you did not initiate
6 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Red flags

⚠ An unsolicited DM from someone impersonating a public figure, government contact, or journalist asks you to open a file link
⚠ The link leads to a standard Google or Microsoft OAuth consent screen asking permission to read your email or files
⚠ You cannot explain why an unfamiliar app appears in your authorized applications list
⚠ Contacts report receiving file-sharing requests from your account that you did not initiate
⚠ You see sent emails you do not recall writing, or calendar events you did not create
⚠ Changing your password does not stop the unusual activity — because no password was stolen

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Sources