A fake crypto site often does not begin by asking someone to hand over coins.
It begins by asking them to participate.
Claim this reward. Join this mint. Connect your wallet. Verify eligibility. Receive an airdrop.
The page frames the action as ordinary participation in a project. The dangerous part is that the wallet may be asked to approve something broader than the user thinks they are doing.
The FBI has warned about malicious NFT airdrops advertised through social media, third-party sites, and phishing messages. Victims are directed to fraudulent pages that ask them to connect a wallet or provide information. The resulting action can allow criminals to move cryptocurrency out of the victim’s wallet.
See the FBI’s warning about fraudulent NFT airdrops and wallet theft.
The story and the permission are different things
A page can say the action is for one harmless purpose while the wallet is actually being asked to approve something else.
That is why the site’s wording is not the final authority.
The wallet prompt is.
Users should slow down and inspect what the wallet says will happen before approving a transaction or permission. If the request appears broader than the activity requires, cancel it.
A free token does not need mysterious authority over unrelated assets. A simple sign-in should not quietly become an asset-transfer approval.
Verify the opportunity outside the link
The FBI advises users who receive unexpected token or reward offers to verify the promotion directly with the cryptocurrency provider before connecting a wallet or supplying information.
That means finding the project’s official site independently rather than trusting a link from a post, direct message, email, or advertisement.
The same rule applies to urgency. A countdown, limited mint, exclusive whitelist, or disappearing reward is not evidence that the offer is genuine. It is evidence that the page wants the user to act before thinking.
If a suspicious wallet action has already been approved, review and revoke permissions using trusted wallet or network tools and move quickly if assets are at risk.
The important distinction is simple.
A wallet connection is not just a login button with a fox icon.
It can carry real authority.
The site tells a story about why it wants that authority. The wallet action reveals what authority is actually being requested.