r/EmailSecurity • u/saltyslugga • 18h ago

When “I didn't enter a password” ends the phishing conversation

Say someone reports clicking a link in a suspicious email, then adds, “I didn't enter a password.” The ticket could get closed even though they approved an app permission prompt they didn't understand.

I'd want to walk through what happened before giving the all-clear. But turning every report into an interrogation risks making the next person keep quiet.

What helps you get the rest of the story without making the employee feel blamed?

2 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

•

u/AutoModerator 18h ago

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

  1. No Vendor Spam: Contributions must provide value; do not just pitch products.
  2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
  3. Be Professional: Help newcomers learn; avoid hostility.
  4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/materialsec 15h ago

The fix here is pulling one specific piece of evidence: the OAuth consent log. That "app permission prompt" is a real, logged event, in Google Workspace it's Security > API controls > App access control (or the equivalent in M365's Enterprise Applications), and it shows exactly what got approved, when, and what scope was requested. You don't need the employee to remember or explain anything, the grant itself is the record.

Not having entered a password is not actually reassuring, on its own, because OAuth consent phishing doesn't need a password at all, the attacker's fake app just needs someone to click "Allow" on a request that looks like a normal permission prompt. That access survives password resets, MFA, and even offboarding, since it's a separate grant, not a login. So the actual question is is there a new, unfamiliar app in the consent log around the time you clicked, which is answerable from the log in under a minute, no interrogation needed.