What to do

Entered a code at microsoft.com/devicelogin or approved an app? What to do now

Updated 23 September 2026

Device code phishing and consent phishing are two versions of the same trick: instead of stealing your password, the scammer gets you to approve their access on the genuine Microsoft or Google website. Your password and your two-factor code never leave your hands, which is exactly why it works. On September 22, 2026, Microsoft said it had taken down EvilTokens, a phishing service built on this method that had broken into more than 12,000 email inboxes, and the FBI warned about the app-approval version on September 1. The fix takes about fifteen minutes, but the order matters.

How can someone get into my account without my password?

Big sign-in systems let you grant access without typing a password into the thing that wants access. That is a good design. It is why you can sign in to a streaming app on your TV by entering a short code on your phone, and why a calendar app can read your Outlook calendar without ever seeing your password. The access comes as a token: a digital pass that says "this person approved this."

Both scams simply point that approval at the wrong party.

• Device code phishing. The scammer starts a sign-in as if they were a smart TV or printer. Microsoft gives them a short code and tells them to have the account owner type it at microsoft.com/devicelogin. They send that code to you. When you enter it and sign in, the "device" that gets signed in is the scammer's computer.
• Consent phishing. The scammer builds an app, gives it an ordinary name, and sends you a link. You land on a real Microsoft or Google sign-in page, sign in, and see a screen asking you to allow the app to read your email, contacts or files. If you click Allow, the app, and whoever runs it, gets that access.

In both cases every page you type into is genuine. The address bar is right, the padlock is there, your two-factor prompt arrives as normal. The advice to check that a website is real before you sign in still matters, but here it does not save you, because the website is real. What gives the trick away is how you got there.

What was EvilTokens?

EvilTokens was a subscription service that sold device code phishing to other criminals. Microsoft tracks the group behind it as Storm-2992. According to Microsoft's threat intelligence write-up, customers paid $1,500 up front plus $500 a month and got 44 ready-made email themes: invoices, requests for proposals, shared files, document signing, Microsoft cloud notices and "password expiring" warnings among them.

The email led to a page that showed a live code with a "Copy Code" button, and often copied the code to your clipboard without asking. It then sent you to the real microsoft.com/devicelogin to paste it. In the background, the page checked with the criminals' server every few seconds to see whether you had finished. Once you had, they were in.

What they did next is the part to take seriously. Microsoft says the attackers created inbox rules and registered new devices on the account so they could keep coming back, and some waited several hours before touching anything, to avoid setting off alarms. Microsoft's Digital Crimes Unit also found a built-in AI chatbot that read through victims' inboxes to find payment approvals, trusted contacts and other openings for fraud. Its warning to organizations: assume a criminal can understand a stolen inbox "in minutes, not days."

Key facts and dates

• Late 2025: the FBI says consent phishing attacks against prominent people and their families began around this time.
• February 2026: EvilTokens appears, BleepingComputer reports, as the first service to offer device code phishing at scale.
• September 1, 2026: the FBI's IC3 publishes a public service announcement on OAuth consent phishing.
• September 11: the Metropolitan Police cybercrime team in London arrests two men, aged 32 and 38, on suspicion of offenses linked to EvilTokens. Both were released on police bail.
• September 22: Microsoft and Health-ISAC announce a court-authorized disruption in the US District Court for the Eastern District of Virginia. 50 websites were seized and more than 150 related domains disabled.
• Scale: more than 12,000 compromised inboxes at more than 10,000 organizations, most of them in the US, Canada, the UK, Australia, India and France.

A takedown slows a service down. It does not retire the technique. The device code flow still exists because TVs and printers need it, and copies of the kits will outlive the people who sold them.

What does the message look like?

The lures are dull on purpose. The ones Microsoft catalogued read like normal work mail: a bid proposal, a partnership agreement, a benefits update, a document waiting for your signature, a shared file, or a note that your password is about to expire. The FBI's warning about consent phishing describes a more personal approach, with messages that pose as officials, journalists or event organizers and invite you to an interview, a panel or a shared folder.

These are the tells worth memorizing:

• You are handed a code you did not ask for. A real device code only appears on the screen of a device you are setting up yourself: your TV, your console, a printer, a command line you typed into. If a code came in an email, a chat message or on a web page someone sent you, it belongs to someone else.
• You are asked to "verify" or "open" a document with a code. Viewing a shared file never needs you to paste a code into Microsoft's device sign-in page.
• An app you have never heard of wants to read and send your mail. A consent screen for a new app asking for mail, contacts and files, reached from a link in a message, is the core of the consent phishing warning.
• Urgency plus a stranger. "Review before end of day," "Your access expires today," "Our editor needs this by noon." The pressure is there to keep you from asking the question above.

Scammers have long tried to get you to read out a one-time code on the phone, the same pattern behind the Apple ID and iCloud storage messages and fake bank fraud alerts. The device code version just moves that request onto a web page and makes you type the code yourself.

I already typed the code or approved the app. What now?

Work through these in order. The order matters because a password change alone does not throw out a token the attacker already holds. The FBI puts it plainly: access from a consent phishing app "can only be revoked by the victim invalidating the token in their application security settings; not by changing the password."

If it was a work or school account

Tell your IT or security team now, before anything else, and tell them exactly what you typed and where. They can do things you cannot: revoke every sign-in session and refresh token on your account, check for devices the attacker registered, find inbox rules, and see whether the same email reached colleagues. Microsoft's own guidance to administrators is to revoke sessions and consider temporarily disabling the account. An early call to IT looks nothing like carelessness from their side. It is the report they were hoping someone would make.

If you approved an app, you can also remove it yourself from the My Apps portal: find the app, choose Manage your application, then Revoke permissions. Permissions an administrator granted cannot be removed there, which is one more reason to involve IT.

If it was a personal Microsoft account (Outlook.com, Hotmail, Live)

1. Remove apps you do not recognize. Go to account.live.com/consent/Manage, the page Microsoft calls "apps and services that can access your data." Open anything unfamiliar and remove its permissions.
2. Sign out everywhere. In your Microsoft account's advanced security options, choose Sign out everywhere. Microsoft says this can take up to 24 hours and does not cover Xbox consoles, which you sign out separately.
3. Change your password, and if you use the same password anywhere else, change it there too.
4. Check your mail rules and forwarding. In Outlook.com settings, look at the rules list and the forwarding option. A rule that moves or deletes messages from your bank, a colleague or "invoice" emails, or a forwarding address you did not set, is the attacker's work. Delete it.
5. Check your recent activity and devices on the account's security page and remove anything you do not own.

If it was a Google account

Consent phishing works on Google accounts too. Go to myaccount.google.com/linkedapps, open each app you do not recognize, choose See details, then Remove access. Google's help page is clear that once you remove access, the app cannot get into your account anymore. Then change your password and check Gmail's filters and forwarding settings for anything you did not create. Removing access stops new reading; it does not pull back what was already copied, so treat anything in that inbox as seen.

What could they have done with my inbox?

More than read it. An inbox is where password resets arrive, so an attacker in your email can often reset other accounts. It holds invoices, bank letters, tax forms and scans of IDs. And it lets them write to your contacts as you, which is the real prize in the business version of this scam: a message from your own address telling a client that your bank details have changed.

After you have locked things down, spend a few minutes on the follow-up:

• Look at your Sent folder for messages you did not write, and warn anyone who got one.
• Change passwords for accounts that reset through this email, starting with banking, other email accounts and anything holding payment details. The same clean-up list is in I typed my card on a fake site, under passwords.
• Tell anyone you pay or who pays you that any change of bank details must be confirmed by phone on a number they already have.
• If the inbox held an image of your ID or your Social Security number, a free credit freeze closes off most new-account fraud. See how to freeze your credit for free.

If money has already moved because of a message sent from your account, go to I paid a scammer: what now. Calling the bank within hours makes a real difference to what can be recovered.

Does two-factor authentication stop this?

Not the kind most people use. With a text code or an app prompt, you are the one completing the check, on the real site, so the scammer gets a sign-in that has already passed two-factor. That is the whole selling point of device code phishing to the people who bought it.

Phishing-resistant sign-in, meaning passkeys and hardware security keys, is the direction Microsoft points organizations toward, and it is worth turning on for personal accounts where your provider offers it. Organizations can also switch off device code sign-in for people who have no need for it. For everyone else, the protection is a habit rather than a setting: only type a device code that your own device just showed you.

How to check a code or app request safely

When a message asks you to approve anything, ask where the request started. If you are standing in front of a new TV or setting up a printer and it shows a code, that is the normal flow. If the code arrived from someone else, stop.

For a document someone says they shared, open OneDrive, SharePoint or Google Drive directly from your own bookmark or app and look in "Shared with me." If it is not there, contact the sender using an address or number you already had, not the one in the message. For a request that seems to come from a colleague or a journalist, the same rule applies. The FBI's advice is to verify who you are dealing with independently and only authorize apps you trust.

If you suspect you are being targeted, save the message. The FBI asks for screenshots of the suspicious messages with a report at ic3.gov or to your local field office, and your email provider can use the original message to block the next one. Our page on where to report a scam lists the other places that take reports.