If the victim chooses to authorize the app, a "token" will be sent to the attacker and the victim's personal sensitive information could be exposed. These information may include the email address, birth date, contacts, and work history.[31] In case the "token” has greater privilege, the attacker could obtain more sensitive information including the mailbox, online presence, and friends list. Worse still, the attacker may possibly control and operate the user’s account.[35] Even if the victim does not choose to authorize the app, he or she will still get redirected to a website controlled by the attacker.