Let’s talk about a phishing technique that doesn’t ask for your password—but can still give attackers access to your account.
Many of us are familiar with verification codes used to confirm our identity when signing in or accessing online services. Because these codes are a normal part of our daily work, it’s easy to assume every request for one is legitimate.
Cybercriminals are now exploiting that trust.
A recent security alert highlighted a phishing technique where users receive an email asking them to review a document or complete a business-related task. The email contains a link that opens what appears to be a genuine Microsoft sign-in page.
Instead of asking for your password, the page simply asks you to enter a verification code.
At first glance, it seems harmless.
However, entering that code can authorize a malicious application to access your Microsoft account without revealing your password.
How the Attack Works
Rather than stealing your password, attackers trick you into approving access to your Microsoft account.
The process typically looks like this:
- You receive an email that appears legitimate.
- The email asks you to review a document or complete an action.
- You are directed to what appears to be a genuine Microsoft sign-in page.
- You are asked to enter a verification code.
- Once the code is entered, the attacker gains authorized access to your account.
Because you approved the request yourself, the attacker may continue accessing your account without needing your password again.
Why This Attack Is Effective
Most employees have been trained to protect their passwords.
Fewer people realize that verification codes are just as sensitive.
Attackers know that users are more likely to share or enter a code than reveal a password, making this technique highly effective.
What Should You Look Out For?
Be cautious if:
- An email unexpectedly asks you to enter a verification code.
- You are asked to paste or type a code into a website.
- You receive a code even though you did not initiate a sign-in.
- A document review or urgent request suddenly requires account verification.
- The request seems unusual or arrives unexpectedly.
If you were not expecting the request, stop and verify before proceeding.
How to Protect Yourself
Before entering any verification code:
- Confirm that you initiated the sign-in or request.
- Never enter a verification code simply because an email instructs you to do so.
- Verify unexpected requests through another trusted communication channel.
- Treat verification codes with the same level of protection as your password.
- Report suspicious emails or authentication requests to the IT Department immediately.
A few moments of verification can prevent your account from being compromised.
Common Thinking to Avoid
- It’s only a verification code.
- The Microsoft page looks genuine.
- I’m not entering my password, so it’s safe.
- The email looks like a normal business request.
These assumptions are exactly what attackers rely on.
Final Reminder
Passwords are no longer the only target.
Verification codes, approval prompts, and authentication requests can also be used to gain access to your account.
Before you enter any code, ask yourself one question:
Did I initiate this request?
If the answer is No, stop and verify before proceeding.
One simple code could be all an attacker needs.
🔐 CyberDesk – Protecting Our Digital Workplace
