They Never Asked for Your Password. They Asked You to Click "Allow."

A message arrives from someone you actually know, asking you to look at a shared file. The link opens a real Google or Microsoft sign-in page. Not a copy, not a lookalike, the real one. You sign in. A screen then asks whether an app may read your mail and your files. You tap Allow, because you were expecting a document.

Nothing was stolen. You handed it over, and the FBI published an alert about this technique in September precisely because the usual fix does not work on it.

Sponsored by Behind the Markets

The largest market in human history

Dear Fellow Investor,

Earlier this year Elon Musk quietly submitted a filing to the federal government.

Most people have never heard of it.

It was drowned out by the biggest IPO in history.

But when SpaceX went public, Elon had to tell investors what this filing was really about.

Here's what SpaceX said, word for word:

"We believe we have identified the largest actionable total addressable market in human history."

SpaceX says that market is worth $28.5 trillion.

That's more than 8 times bigger than everything Elon has ever built, combined.

Former Wall Street CEO Dylan says it has nothing to do with the SpaceX IPO, self driving cars or robotics.

And it puts one obscure AI firm at the center of Elon's plan.

Dylan calls it "Elon's 100X AI Stock."

Elon has been quietly paying this firm since 2012.

Now Dylan's research indicates shares could start to take off in a major way on October 24.

See the AI stock behind Elon's $28.5T plan before October 24 here >>

The Buck Stops Here,

Kelly Maguire

Behind the Markets

P.S. SpaceX told investors about the $28.5 trillion market. It didn't name the AI firm at the center of it. Dylan does.

Get the name before October 24 here >>

Look Behind the Curtain

The technique is called consent phishing, and it borrows a feature rather than breaking one.

Every major cloud provider lets outside apps connect to your account with your permission. That is how a calendar app reads your calendar and a backup tool reads your files. The attacker registers an ordinary application with the provider, gives it a reassuring name along the lines of a file-storage or identity-verification service, and configures it to request broad permissions such as reading and writing your email and documents.

Then they send you to it. The sign-in page is genuine, which is why the usual advice about checking the address bar fails here. Your password goes to the provider, never to the attacker. Multi-factor authentication works exactly as designed, and you pass it. What the attacker collects is the permission you grant on the next screen: a token that lets their application reach your data on its own, from then on.

Two consequences follow, and the FBI states both. Multi-factor authentication does not stop this, because the attacker is not logging in as you. And changing your password does nothing, because the token was never tied to the password. It can only be revoked by invalidating it in your account's own security settings.

That is the whole problem. The person who discovers the breach, changes to a long new password, feels relieved and moves on has not closed anything.

The delivery is personal rather than mass-mailed. The alert describes approaches through email, text and messaging apps, with the sender impersonating officials, journalists or event organizers, and messages arriving through accounts that belong to real contacts. A request that looks like it came from a colleague is the point of the design, not a coincidence.

The Capability Multiplier

The advantage is that the defense is a single screen most people have never opened, and five minutes in it protects you against every version of this.

Every account you own keeps a list of the third-party apps you have connected. Google calls it your connections to third-party apps and services. Microsoft keeps it under app permissions in account settings. Apple, Facebook and your bank all have an equivalent. Open the list and you will find things you authorized in 2019 for a trial you abandoned, each still holding permission to read whatever you agreed to.

Revoke anything you do not recognize or no longer use. This is not a password change, so there is nothing to memorize, and nothing you still use will break silently: you will simply be asked to sign in again.

The habit worth building is reading the permission screen as a contract rather than a doorway. The screen names the app and lists what it is asking for, and the mismatch is usually obvious once you look. A link to a shared document has no reason to request the ability to send mail as you.

The Sovereign Action

Five minutes now, then once or twice a year.

• Open the connected-apps list on your main email account and revoke every app you do not recognize or no longer use. Start with anything requesting access to mail or files.
• Read the permission screen before you tap Allow. If the request is broader than the task, close the page.
• Treat an unexpected document link as unverified even when it comes from a real contact, and confirm through a channel you chose yourself.
• If you think you approved something, revoke the app first and change the password second. In that order, because the reverse accomplishes nothing.
• Report it to the FBI's complaint center at ic3.gov and keep screenshots of the messages. Their alert asks for both.

We encourage all readers to consult a qualified financial professional — such as a registered investment adviser or licensed broker — before making any investment decision.