Bottom line: do not trust the button text on a website. Read the wallet prompt and identify whether it is a connection, message signature, token approval, permit, NFT operator approval or immediate transaction. Reject what you cannot explain.
What each request can mean
| Request | Typical effect | Main risk |
|---|---|---|
| Connect | Shares a public address and lets the site request actions | Privacy and follow-up signature prompts |
| Sign message | Proves control or agrees to structured data | The signature may be reusable |
| Approve | Lets a contract spend a token allowance | Unlimited allowance can expose the token later |
| Permit | Creates spending permission through a signature | No immediate gas does not mean no risk |
| Send / contract call | Broadcasts an on-chain action | Confirmed transfers are generally irreversible |
Disconnecting is not revoking. A disconnected DApp may still have an allowance recorded on-chain. Revocation requires a transaction on the correct network and usually costs gas.
Common lures
- Urgent airdrops or allowlists.
- Fake support offering to repair a stuck wallet.
- Fake refunds, compensation and approval-revocation pages.
- Unknown tokens or NFTs containing a phishing URL.
- Address poisoning that places a lookalike address in transaction history.
Twenty-second pre-signing check
- Did you initiate this exact action?
- Is the full domain independently verified?
- What request type does the wallet show?
- Who is the spender or operator?
- Which token, collection, network, amount and expiry are affected?
- Does a hardware-wallet screen show the same destination and amount?
If you already signed
Stop using the site, preserve its domain and any transaction hash, inspect allowances on the correct network and revoke unknown permissions. If unauthorized activity appears, move remaining assets to a clean wallet. A leaked seed phrase cannot be fixed by revocation or a password change; replace the wallet entirely.
MetaMask explains both malicious token approvals and approval revocation. Use the wallet scam checker for situation-specific steps.