Phishing sites and dApps: how connecting a wallet leads to theft

What a phishing site looks like

• A copy of a well-known DeFi service, exchange or wallet with an address one letter or domain zone off.
• A page saying “claim your reward”, “check your wallet for AML”, “unlock frozen USDT”.
• The link arrives in a DM, a comment, an ad or a look-alike “official” channel.
• A timer, “3 spots left”, “today only” — so you do not have time to think.

What you are really signing

The wallet shows a confirmation window. Look at the function name:

• approve / increaseAllowance — you allow someone else’s address to spend your token, often an unlimited amount, see unlimited approvals.
• transfer / transferFrom — a transfer right now. Check the recipient and the amount.
• Account permission change (AccountPermissionUpdate) — you hand over control of the wallet. Always reject, see the multisig trap.
• Message signature — can be safe, but not always, see phishing through message signing.

If you already signed

1. Open GuardPay /revoke and paste your address. You will see who may spend your USDT, read straight from the contract.
2. Revoke suspicious approvals in your wallet: one signature each.
3. If the account permissions were changed, the wallet is no longer yours: move everything you still can to a new address.
4. If the money is gone, start with the steps in what to do if you were scammed.

Habits that protect you

• Open services from bookmarks, not from links.
• Keep a separate wallet with a small amount for connecting to sites.
• Once a month check your approvals in /revoke and revoke the ones you no longer need.