A Code On A Screen Opened 12,000 Inboxes. Teach Your Teen This.

This week Microsoft announced it had helped shut down a criminal service called EvilTokens. Anyone could rent it on Telegram for a $1,500 sign-up fee and $500 a month. Since it appeared in February 2026, it had been used to break into more than 12,000 email inboxes at more than 10,000 organizations.

The trick at the center of it was not a virus or a fake password page. It was a short code.

The victim got an email. The email said, in one of 44 different disguises, that they needed to type a code into a real Microsoft website to see an invoice or a shared file. The website was real. The code was real. And the moment they typed it, they gave a stranger a working key to their account, and their two-step verification did not stop it.

Your teenager has probably typed a code exactly like that. It is how you sign into a streaming app on a smart TV or a game console. That is why this story is worth ten minutes at the kitchen table.

Some devices are bad at typing. A smart TV, a printer or a conference room screen does not have a keyboard you want to use. So companies built a shortcut. The TV shows a short code. You open a website on your phone, type the code, and log in there. The TV is now signed in as you.

That shortcut is legitimate. Microsoft calls it the device code flow, and many services use something similar.

Here is the weakness. The code does not know which device asked for it. If a scammer starts the sign-in on their own computer, they get a code. If they can talk you into typing that code on the real website, you have just signed their computer into your account.

You did everything that normally feels safe. You checked the web address. You used your real password. You approved the two-step prompt. The scammer did not need your password at all.

Because it did not look like a scam. It looked like work.

Microsoft's researchers said the lures were built around invoices, requests for proposals and shared files, the kind of thing people click every day. EvilTokens also gave criminals AI tools that read through a hacked inbox, figured out who handled money and who they trusted, and then wrote the next fake message in a believable voice.

After getting in, attackers often created hidden inbox rules so the real owner would not see replies. Some used the access to add a new device to the account so they could keep coming back.

Microsoft's Digital Crimes Unit worked with Cloudflare, Coinbase, OpenAI, SpyCloud and others to seize 50 websites and disable more than 150 domains. Two men, aged 32 and 38, were arrested in the United Kingdom. Security reporters have already noted copycat services.

So the tool is gone. The trick is not.

Three reasons.

Teens use code-based sign-ins more than most adults. Consoles, streaming apps, school tablets and smart speakers all use them.

Teens are handling money earlier. Everfi's survey of 161,900 high school juniors and seniors found that 51 percent already use a mobile banking app and 48 percent use peer-to-peer payment apps. The accounts are real, and so is the money in them.

And many do not feel ready. In the same survey, 52 percent said they felt unprepared to recognize money-related scams, and 56 percent felt unprepared to use payment apps safely.

A teenager who runs a small business, even a lawn-mowing side gig with a payment app, is exactly the kind of target these tools were built to find: someone with an inbox, a way to get paid and not much practice spotting fakes.

Only type a sign-in code that you can see on a screen you are holding or sitting in front of.

That is it. If the code came in an email, a text, a chat message, a phone call or a pop-up from someone else, do not type it anywhere. It does not matter if the website is real. It does not matter if the person says they are from school, the bank or a game company.

Codes that come from other people are keys to your account, not proof of who you are.

The same rule covers the other code scams teens run into: a friend asking you to read back a verification code that was just texted to you, or a seller on a marketplace app asking for one to prove you are real. In every case, the code is the key. Keep it.

Rules stick better when you use them once. Try this.

1. Sit down together with a smart TV or console and sign into one app using the code method. Point out that the code appeared on the screen in front of you, and that is why it is safe.
2. Now write a fake email on paper: "Your invoice is ready. Go to the real sign-in page and enter code F7K2-9QX to view it." Ask your teen what they would do.
3. Talk through why the paper version is different. Nobody is standing in front of the device that asked for the code.
4. Open the security page on one of their accounts together and look at the list of signed-in devices. Remove anything they do not recognize.
5. Agree on a family phrase for when something feels off. Something like "check before you type." Make it the default to ask, with no penalty for asking.

If your teen runs a small business or a side hustle, write the rule and the phrase into the same notebook where they track money. Some families keep a simple business plan in a notebook, a spreadsheet or a planning tool like Foundra, and a short security page belongs next to the prices and the customer list.

Act fast and do not make it a punishment. Kids who fear getting in trouble hide mistakes, and hidden mistakes cost more.

Change the password on the account. Sign out of all devices from the account's security page. Look for new inbox rules or forwarding settings that nobody set up. Tell the bank or payment app if money could be involved. If it is a school account, tell the school's tech team the same day.

Then go back to the one rule, and move on.

The one rule does most of the work. These signs help your teen notice a lure before they reach the part where a code comes up.

Urgency. "Your account will be closed today." "Payment is overdue." Real companies rarely give you minutes to act.

A reason to go somewhere else. The message sends you to a different site or app to finish something, instead of letting you do it where you already are.

A request that skips a step. A friend, coach or buyer asking you to handle something unusual by message, especially if it involves money or a code.

A perfect message. Old advice said to look for bad spelling. AI tools like the ones inside EvilTokens write clean, friendly messages in the voice of someone you know. Good grammar is no longer proof of anything.

A message that knows a little too much. If a stranger mentions a real teacher, a real team or a real order, it may be because they read someone's inbox. Familiar details are not the same as a trusted sender.

When your teen sees two of these at once, the right move is to stop and ask. Asking costs nothing. Typing the wrong code can cost the whole account.

What was EvilTokens? A criminal phishing service sold on Telegram that helped scammers trick people into typing sign-in codes. Microsoft says it was used against more than 12,000 inboxes before it was disrupted.

Does two-step verification stop device code phishing? Not on its own. The victim completes the two-step check themselves, which is why the trick works.

Are code sign-ins on TVs and consoles unsafe? No. They are safe when the code comes from the screen in front of you. The danger is a code sent by someone else.

What age should I teach this? As soon as your child signs into anything with a code, often around 10 to 12. The rule is short enough for younger kids to remember.

What should my teen do if someone asks them to read back a code? Say no and tell a parent. Real companies do not ask you to share a verification code with anyone.

1. Unmasking EvilTokens: Getting to the root of device code phishing, Microsoft Security Blog, September 22, 2026
2. EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts, BleepingComputer
3. Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes, Help Net Security
4. Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises, The Hacker News
5. The State of Teen Financial Literacy in 2026, Everfi