Why Do Fake Crypto Websites Ask You to Sign a Message?
A signature feels safer than a transaction — no gas, nothing visibly on-chain. Fake sites exploit exactly that. Here's why some signatures are just as risky.
A signature request feels less consequential than a transaction — no gas fee, no obvious on-chain action, just a quick confirmation. Fake crypto websites specifically exploit that perceived lower stakes, often preferring a signature request over a traditional transaction wherever the two can accomplish a similar goal.
Why Signatures Feel Safer Than They Actually Are
Because signing doesn't cost gas, it registers as a lower-risk, almost administrative action.
Permit and Permit2: Signatures That Function Like Approvals
Certain signature standards can grant the same practical spending permission as a traditional on-chain approval, achieved off-chain instead.
Why Fake Sites Frame Signature Requests as Routine Steps
A signature request gets commonly framed as "verifying your wallet" or "confirming eligibility."
Why Wallet Interfaces Make This Harder to Catch
Many wallet apps display signature details less clearly than transaction details.
Batching Multiple Signatures Together
Some fake sites request several signatures in sequence, spreading a broader compromise across several unremarkable-looking requests.
Why This Tactic Specifically Targets More Cautious Users
Someone who scrutinizes approval transactions carefully may not extend that same scrutiny to a signature request.
What to Check Before Signing Anything
Whether a wallet's signing prompt shows plain, readable text or structured data — the same distinction that matters for any message signature.
Check a site's legitimacy before signing any message it requests — some signature requests carry the same risk as a full token approval, just without looking like one.