Signature Scams: Login Signatures vs. Transfer/Approval Signatures

Bottom line first: A wallet shows two kinds of "signature" — one only proves "this wallet is yours" and can't move your money; the other is an approval/transfer signature, and signing it hands over the power to move funds. The whole scam is dressing the second up as the first.

1. Two signatures, distinguished at a glance

	Login signature (wallet confirmation message)	Approval / transfer signature
Purpose	Prove you own the wallet	Allow the other side to move your assets
On-chain?	Not on-chain, not broadcast	The approval can be submitted on-chain later
Gas?	Never any gas	May have gas, or appear as a "gasless" approval
When it appears	Usually right when you connect to a dApp	May sit behind "claim" or "verify" buttons

2. What you see should make you stop

1. The pop-up shows a gas fee, but you thought it was a "login" → stop. A wallet confirmation message never has a gas fee.
2. The pop-up shows a contract function name, such as SetApprovalForAll, SafeTransfer, or SendEth → stop. A login signature doesn't call contract functions.
3. The pop-up shows a "spender / allowance / deadline" → this is an approval, not a login. A real login grants no spending power.
4. It asks you to sign in order to "accept an incoming transfer" → stop. Incoming transfers need no action from you; asking you to sign is asking you to sign an outgoing transfer.
5. A pop-up at a random time, not while you're actively using the dApp → stop.

3. Why "gasless" doesn't mean safe

Login signatures don't touch the chain and cost no gas — convenient, yes — but scammers exploit exactly the "no gas, nothing happened" reflex:

• The scammer dresses an approval up as a "login": you think you're proving identity, but what you sign is an authorization that can be used later.
• An approval / transfer signature is an off-chain authorization that can be used later — not seeing a transfer now doesn't mean it doesn't exist; the dApp collecting the signature can use the signed message at a time of its choosing.
• The allowance can be set far above your balance, so "I don't hold much" is no reason to feel safe.

4. If you've already signed something suspicious

1. Move your assets to a new, clean address (don't count on the approval expiring on its own).
2. Use a tool such as revoke.cash to revoke the approvals you've granted.
3. From now on: don't enter a dApp from a DM, an ad, or a "you've won" link — type the address yourself or use your own bookmark.

5. Our tools and our honest limits

They can help sort the operational layer: transfer self-check, Four things to check before any transfer.

What we can't do:

• We don't touch your funds, and we can't revoke a signature or recover stolen assets for you.
• We can't stand in for official support: account freezes and appeals go only through the platform's official channels.
• We give no direction and no trade signals; this page covers safe operations only, with no market calls.

Next steps

• Get the four basic transfer errors straight first: Four things to check before any transfer
• Work out the hidden costs: total cost ledger

---

Data source and fetch time: signature phishing (off-chain signatures can be used later), the meaning of a token-approval allowance, and the revocation tool are from the MetaMask Help Center (fetched 2026-10-12T15:32:51Z); the rules that a wallet confirmation message has no gas fee and doesn't call contract functions, and that incoming transfers need no action, are from Ledger Academy (fetched 2026-10-12T15:32:51Z).

Disclaimer: This site provides education and tools, is not investment advice, and does not provide trading signals.