The dangerous moment in a crypto scam is often the moment a wallet asks for authority. A page may call it verification, a claim, or a routine connection. What matters is the request underneath: a transfer, permission to spend tokens, or a signature someone can use later.
The companion video surveys phishing, malicious approvals, and rug pulls. This article concentrates on the wallet prompt. The examples describe Ethereum-style permissions where relevant; other chains, wallets, and account systems have different mechanics. No list of warning signs can certify a contract as safe.
Separate three actions that can look similar
A page can use the same friendly button for requests with very different consequences:
| Request | What it does | What to establish |
|---|---|---|
| Connect | Normally shares the selected public address and lets the application request further actions | Which application is receiving the connection |
| Transfer | Sends assets according to a signed transaction | Destination, asset, amount, and chain |
| Token approval | Grants a spender authority over a particular token, subject to its allowance | Spender, token, and spending cap |
A connection is therefore no explanation for an approval prompt. The next request needs its own justification.
MetaMask’s token approval explanation describes that permission and the spending cap. It can exceed the current token balance. That matters because a request is about authority, not merely the money visible in the wallet today.
Suppose a fictional page offers a reward and requests permission to spend a token you already hold. That is a different action from receiving a reward. Before signing, state the request in ordinary language: this spender may move up to this amount of this asset. If you cannot establish those details, declining the request preserves the chance to understand it later.
A message can carry spendable authority
A prompt labeled “Sign message” may feel harmless because it does not visibly transfer money or charge a network fee. Some signatures are used for ordinary authentication. Others authorize actions with financial consequences.
MetaMask documents signature phishing, including attacks that obtain off-chain authorization and use it later. An attacker does not necessarily need a successful transfer in the same moment that you sign.
The distinction is the content and context of the signature. Which application requested it? Which chain and verifying contract does it concern? Does it name a spender, asset, amount, or expiration? A wallet may expose some of these fields clearly and others poorly. An unreadable request is a limit on your ability to assess it, not a reason to trust the website’s summary.
Follow the route to the request
Imagine opening a link in a message that appears to come from a project’s support team. The site looks familiar, the logo is correct, and the page warns that your wallet must be repaired immediately. None of those details establishes that the sender represents the project.
Leave the message and find the organization’s known website or support channel independently. Check the exact domain and the announcement there. Do not use another link supplied by the same sender as your independent confirmation. The FTC’s cryptocurrency scam guidance describes impersonation and demands to move money under a false pretext.
Urgency deserves special scrutiny when it prevents that check. A countdown can be real, but it cannot explain why a supposed reward needs broad access to unrelated holdings. Answer the permission question before the deadline question.
A small transfer is a limited test
Sending a small amount may reveal an incorrect destination or network before a larger transfer. It cannot prove that a contract’s future behavior is safe. Nor does it limit an approval you separately grant.
For example, a successful $5 test and an unlimited allowance are different facts. The test says that one action succeeded. The allowance says the spender has continuing authority under that permission. Combining them into “the wallet interaction is safe” goes beyond what you checked.
A hardware wallet protects the private key from extraction, but its owner can still approve a harmful authorization. Read the action on the trusted display when supported. If the website says ‘receive reward’ while the request grants spending authority, the hardware has not resolved that mismatch for you.
Limits need to match the asset and the task
If a legitimate application requires a permission, compare the spender and amount with the intended action. An allowance for a limited task should be understandable in those terms. A large or unlimited cap requires an explanation beyond convenience.
Keeping experimental activity separate from important holdings can reduce some consequences, but the separation must be real. Two accounts derived from the same exposed recovery phrase do not isolate a recovery-phrase compromise. Separate balances also do not prevent a scammer from persuading the owner to move more money into the exposed account.
Do not treat clean-looking branding, social engagement, or an audit badge as permission evidence. Verify a claimed audit at the auditor’s own source and read its scope. Even a legitimate assessment describes what was examined; it is not a blanket guarantee for every website that invokes the project’s name.
Disconnecting is different from revoking
Closing a tab or removing a website connection does not undo an authorization already recorded on chain. MetaMask’s revocation guidance explains that token approvals need their own review and revocation.
If you suspect a malicious approval, stop using the suspect page and consult the wallet provider’s official instructions through an independent route. Identify the chain, token, and spender involved. A revocation must be submitted and confirmed; pressing a button in a fake tool changes nothing useful.
Revoking one allowance does not repair an exposed recovery phrase, reverse assets already transferred, or necessarily cancel every type of signed authorization. If keys or a recovery phrase were exposed, follow the provider’s compromise procedure. Avoid entering that phrase into an unsolicited form or giving it to someone who promises recovery.
Preserve evidence without entering another trap
Save the transaction hash, addresses, network, website URL, and relevant messages. These help a wallet provider, platform, or investigating authority understand what happened. Reporting does not guarantee that assets will be returned.
Be particularly cautious of someone demanding a further payment to release funds or recover a loss. The FTC’s guidance explains why recovery promises and fabricated investment balances can keep victims paying. Verify assistance independently and do not grant a new stranger control over the wallet.
Before any request, make a simple comparison: what you intended to do versus what the wallet is authorizing. A mismatch is enough to pause. You do not have to prove criminal intent before refusing to give away authority you do not understand.
