05/20/2026
OAuth Consent Phishing Scam
TL;DR:
When you choose to login to a website with your Google or Facebook account, you are normally safe. However, if you receive an email from an unknown sender that wants you to login with these methods, you may be at risk of having your credentials stolen. Always check that the website you are logging into is VERIFIED and it only asks for permission to your name, email and profile photo. [otherwise, it could be a scam]
Your everyday use of "Sign in with Google" on major public websites (like Spotify, Pinterest, or Canva) is generally safe. The risk arises when you encounter an unfamiliar app or click a login link sent via an unexpected email or message.
How to Protect Yourself
Protecting yourself requires shifting your mindset from protecting your password to protecting your permissions.
1. Audit Your Current Connections Right Now
Take a few minutes to clean out the apps that already have access to your account.
• Go to your Google Account Settings.
• Navigate to Security and look for Your connections to third-party apps and services.
• Review the list. If you see an app you no longer use, or one you don't recognize, click it and select Remove Access.
2. Scrutinize the Consent Screen Before Clicking
Whenever you use Google to log into a new site, a consent screen pops up detailing exactly what the app wants. Treat this like a legal contract.
• Check the Publisher Name: Google displays the developer's name. If it says "Unverified," or if the name doesn't match the website you think you are on, cancel immediately.
• Look at the Scope (Permissions): A basic login should only ask for your name, email address, and profile picture. If a random app requests permission to "Read, send, and delete emails," "Manage your Google Drive files," or "View your calendar," that is a massive red flag.
3. Watch for "Unverified App" Warnings
If Google's automated systems haven't thoroughly vetted an app requesting sensitive data, you will see a stark warning screen that says "This app isn't verified." Attackers will often instruct you to click "Advanced" and bypass this warning to proceed. Never bypass this screen unless you are 100% certain of the developer's identity.