What is a device code?
A device code is a short string of numbers and letters which allows users to log in to their accounts on devices which might not use a keyboard; for example, an app for your television. It might take a long time to sign in using the on-screen keyboard, or users might not know their passwords. Instead, you can use a device code.
To use an app like Netflix or Disney on a new device, you have to tell the app you want to log in. When you select the sign in option on your TV, you’re requesting a device code. The TV then generates a device code and shows it on the screen. You can then use your phone to open the Netflix app or Disney app, or a webpage, and enter this code to approve the sign in.
Then, you’re logged in to your Netflix or Disney account, on your television. You don’t usually have to approve a sign in option again; once you have approved the log in on your phone, your TV remembers it and keeps you signed in. Device codes can be useful, and are accessible ways of logging into your accounts.
How are phishers using device codes?
In a device code phishing scam, instead of the user requesting the device code, the scammer does. The scammer tells a service or app that they are a device, and that they need a device code in order to sign in. The service provides that code.
The phisher now needs a victim; a user that will take this device code, and approve it. The scammer sends a phishing email to you. In this email, there is a link to something which requires you to log in to an account, and the device code that the scammer has requested. The email will suggest that you need to input the code in order to access something like a secure webpage, or a PDF.
In the example we saw, the email had a link to a log in screen for Microsoft. This log in screen is legitimate; clicking the link really does take you to a Microsoft log in screen where you’re asked to input your details. However, the code that you’ve been asked to enter isn’t authorising you to access a secure webpage; it’s a device code that allows a device access to your account. And in this case, the device is a phisher.
The victim then enters the code, thinking that they’re gaining access to an important document or webpage. Instead, they’re giving permission to Microsoft to allow a phisher access to their account.
Don’t fall for fake device code requests
This scam is particularly dangerous, because device codes often provide continual access to an account. Here’s what you can do to ensure that you don’t fall for fake device code requests.
- Unless you requested the code, don’t use it
Device code requests are meant to facilitate log-ins from a device that you’re looking at. Just like in the example with Netflix and your television, the code should have been requested by you.
When someone sends you a code, and tells you to log in to something, be wary. Codes like these are meant to be requested by you, not requested by other people and then sent to you. Unless you requested the code, don’t use it. - Read your webpages
In the example we saw, Microsoft clearly states that once you enter the code displayed on your app or device, the device will have access to your account. It also gives a warning, ‘Do not enter code from sources you don’t trust’.
It’s very easy to skim read these pages, but if you are asked to put in a code to gain access to something, the page you’re logging into should state this. It shouldn’t say that you’re allowing a device to access your account. In this case, all the information is in front of you. - Check your sign-ins
For apps which allow you to sign in on multiple devices, you can head to the Settings and see where you are signed in, and on which devices. If you see something suspicious, you can sign out from certain devices. This will usually be under ‘Sign in activity’ or ‘Devices’ - Send it to Junk
Like with all phishing emails, the best way for you to keep yourself safe is ensuring that you don’t click any links in suspicious looking emails. If the graphics aren’t right, there are spelling mistakes, or you don’t recognise the sender, save yourself the stress and send it to Junk.
