You are waiting for a client brief. A message says the document is ready, then a page asks you to let an application read your email. Before accepting, ask why viewing this file should require opening your mailbox to an application.
A 1 September 2026 FBI alert describes campaigns observed since late 2025: fake sharing invitations use genuine authorization screens. Its targets include prominent people; it does not measure the risk among freelancers.
The request fits a task you already expect
Consider a fictional scenario: you are preparing a brochure and your contact is due to send photographs. “Here are the images” is exactly the message you expect. You may be tempted to finish signing in without reading the permissions.
The useful warning sign is the gap between the task and the requested access. Viewing a photograph and allowing an application to read or send your email are different decisions. Even when you recognize the sign-in provider, check the application’s name and what it is asking to do.
If the request is unexpected, close the page. Contact the client through a channel you knew before receiving the message, such as a saved phone number. Ask which file they intended to send and which service they used. Replying inside the suspicious conversation does not provide that independent check.
A strong password does not settle every permission decision
Use a unique email password and enable multi-factor authentication. The Australian cyber security authority identifies password reuse and phishing as routes to account compromise and recommends MFA.
Where your provider supports them, consider passkeys too. Google describes them as more resistant to phishing than passwords. Protecting sign-in does not make an unexplained access request appropriate.
Separate the checks: “Is this the service I expected?” and “Is this the application I want to grant these permissions to?” Do not let the habit of approving a sign-in become automatic approval of application access.
Give clients a sharing process they can recognize
At the start of a project, explain where you will place files and how you will announce revisions. The client then has something to compare an unexpected sign-in request against.
A DocBunker folder can be the agreed place for documents and feedback: clients use the folder link without creating an account. Email can remain the channel for short messages. Our page on the client portal for agencies illustrates this arrangement.
That reference point does not guarantee a message is authentic. Anyone holding an active folder link can use it. If your mailbox is compromised, links stored there may be exposed too. DocBunker does not prevent email account compromise or retrieve copies people have downloaded.
Already approved? Check connected applications too
For this case, the FBI says to revoke application access: changing the password alone does not remove that permission.
Follow your provider’s official recovery process. For Gmail, Google advises reviewing account activity, devices, authorized applications and forwarding rules. If your organization manages the account, notify the person responsible for its security. Preserve the message details so they can investigate.
For the next project, agree on a sharing channel and a simple rule: an unexpected request for mailbox access deserves a check before anyone selects “Allow”. For a consistent place to gather revisions, read our article on folder comments and email feedback.
