4. Creating an App-Specific Password (ASP) Rather than entering their real password, victims are asked to generate an ASP via account.google.com, a 16‑character code meant for third-party apps.