# Device code phishing

Device code phishing abuses the OAuth device authorisation flow: the attacker sends the victim a real sign-in code page, and when the victim enters the code the attacker's session receives the tokens.

## How it works

The device code flow exists for TVs and consoles that cannot show a browser. The attacker starts a sign-in, obtains a short user code and asks the victim, by email or chat, to enter it at the official device-login page.

The victim signs in on the genuine provider site, so nothing looks wrong, but the session is granted to the attacker's device.

## How to protect yourself

- Only enter a device code that your own device is showing you at that moment.
- Organisations can block the device code flow where it is not needed.

## Related tools

- [EML Analyzer](https://phishdestroy.io/developer-tools/eml-analyzer)

## Related terms

- [OAuth consent phishing](https://phishdestroy.io/glossary/oauth-consent-phishing/)
- [Business email compromise (BEC)](https://phishdestroy.io/glossary/bec/)

## Further reading

- [Why Email-Only Abuse Reports](https://phishdestroy.io/why-email)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/device-code-phishing/