Malicious OAuth consent
A fake app asks for permission to read your mail and files, bypassing the password.
How to spot it
- Unknown app asking for broad access
- Consent screen reached from a link
What to do
Decline unknown apps; ask IT to review app permissions.
What the real thing looks like
- An approved company app your IT lead announced
Try an example
A practice example with fictional companies. Answer it, then see the tells.
Is this website a scam or legit?
Secure connection (padlock)Address: https://login.microsoftonline.com/common/oauth2/authorize Page title: Permissions requested
DocFlow Viewer wants to access your account
This app would like to: read your mail, read all your files, send mail as you, and keep access until you remove it. Publisher not verified.
AcceptSure and right: +15. Sure and wrong: -5. Calling a legitimate item a scam counts as a miss.
Test yourself on eight more
The free quiz mixes scams with legitimate messages, like real life. No sign-up.