A genuine sign-in page can still lead to a scam. Read the “Allow” screen

You receive an invitation to a document, conference or journalist interview. The link opens a genuine Google, Microsoft or other familiar sign-in page. The address is correct, your password works and the second sign-in step appears as usual. Then you reach a screen with an “Allow” button.

That final screen may be the entire point of the scam. You are not giving a password to a fake website. You are granting an unfamiliar application permission to act through your real account.

The secure site proves the page, not the app’s intentions

Convenient “Sign in with Google” or “Sign in with Microsoft” buttons let services connect without creating another password. An app may ask only for basic profile details, but it can also request permission to read email, send messages, access files, contacts or calendars.

The genuine provider page accurately displays that request. It cannot know whether you expected the app or whether the person who sent the link told the truth. A secure domain does not turn excessive permission into a sound decision.

Before approving, read three things: the application name, publisher details and the list of actions being requested. The question is not merely “Do I trust Google or Microsoft?” It is “Do I know this particular app, and does it genuinely need my email or files?”

An invitation should not require control of your mailbox

A scammer may pose as an event organiser, government official, media contact or somebody sharing a document. The story supplies urgency, while the permissions screen feels like a formality between sign-in and the promised content.

Pause when the app has a generic name, an unknown publisher or permissions unrelated to the task. Viewing one document does not require the ability to send messages as you. Registering for an event does not require access to every file.

If you are unsure, close the tab and contact the sender through another channel. At work, ask IT or the service owner whether the app is approved. Do not paste the complete link into a public chat; the app name, a screenshot of the permissions and the source of the request are enough for an initial check.

Changing the password alone may not be enough

After you press “Allow”, the app may receive its own access that works without asking for your password again. A password change therefore does not necessarily remove the permission you granted.

If you approved the request, open your account settings directly and find connected apps or third-party services. Revoke the unfamiliar app and review recent account activity. Check the mailbox for sent messages and rules you did not create. Report it immediately at work, where an administrator may be able to inspect the permission scope and revoke access more broadly.

Keep the original message until it has been reported. Record the app name, requested permissions, time and sender. Those details are more useful than simply saying “I clicked a suspicious link.”

Make the right decision easier at work

A consent screen is difficult to judge if an employee first encounters one during an urgent task. Organisations should show examples of basic and excessive permissions and publish either a list of approved apps or an easy verification route.

Administrators can restrict self-service approval for higher-risk permissions and require review. That does not replace employee guidance, but it moves the hardest decisions to somebody who has the context to assess the supplier.

What the source confirms and what Breachroad recommends

On 1 September 2026, the FBI described an account-takeover campaign based on granting access to a malicious app. Since late 2025, actors had approached prominent people, family members and acquaintances while impersonating officials, media representatives or event organisers. A genuine consent screen gave the malicious application permission to read and send email and access data. The FBI stresses that the app must be revoked and that changing the password alone may not invalidate its access. The advisory does not say that every consent request is malicious or that the campaign affects every country at scale.

Breachroad’s conclusion is to treat the “Allow” screen as an access decision, not the final formality of signing in. Our guide to unexpected shared-document invitations covers the surrounding lure. Organisations can turn permission language into simple habits through cybersecurity awareness training.