Scam library
Malicious app permissions
A shared file or invitation tricks you into giving an unfamiliar app access to your email or files.
What it looks like
Fictional example: Review the document at example.com/shared-file. Select Allow so our viewer can read your mailbox.
Fictional example: Your invitation requires identity verification. Approve this app's access to your email and contacts.
How it works
A message directs you to a real account provider's permission screen for a malicious app. Approving it can let the app read files, access email, or send messages as you. Changing your password alone may leave that permission active.
Warning signs
- Viewing one document requires broad email or file access.
- The app name or publisher is unfamiliar.
- The requested permissions exceed the stated purpose.
- An unexpected invitation insists you approve access immediately.
If you got one of these
- Decline permissions you do not understand or need.
- Verify the sender through a separate, established channel.
- If you approved access, remove the app from your account's connected-app security settings.
- For a work account, tell your security team promptly.
If you already paid or shared something
- Contact your bank if the account compromise led to a payment.
- Revoke the app's access, then review sessions, forwarding rules, and recovery settings.
- Warn affected contacts and preserve the permission screen and messages for ic3.gov.
Who gets targeted
People using cloud email and shared documents, including workers, community organizers, and their contacts.
Protect yourself: The Ten-Minute Kit