# How device code phishing gives scammers access to your account

DevFeed: [How device code phishing gives scammers access to your account](<https://devfeed.tech/articles/how-device-code-phishing-gives-scammers-access-to-your-account-58951.md>)

Original publisher: [Read original article](<https://www.malwarebytes.com/blog/how-to/2026/09/how-device-code-phishing-gives-scammers-access-to-your-account>)

Author: Pieter Arntz

Published: 2026-09-23T18:59:38Z

Content type: tutorial

Language: en

Sources: [Malwarebytes](<https://devfeed.tech/sources/malwarebytes.md>)

Topics: [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Social engineering](<https://devfeed.tech/topics/social-engineering.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [device-code-phishing](<https://devfeed.tech/tags/device-code-phishing.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

## AI overview

This article explains how device code phishing tricks victims into approving a legitimate sign-in request initiated by an attacker. It describes the OAuth 2.0 Device Authorization Grant, the role of social engineering, the resulting authentication tokens, and why MFA may not prevent the attack.

## Source excerpt

A scammer asks you to enter a code to open a file or join a meeting. Approving it could sign them in to your account instead.