Token Approval Scam
Pronunciation: TOH-kuhn uh-PROO-vuhl SKAM
Definition
A token approval scam tricks a wallet user into granting a malicious contract or address permission to spend tokens, often by disguising the approval as a harmless verification, giveaway or checkout step.
Overview
What it means and why it exists
A token approval scam tricks a wallet user into granting a malicious contract or address permission to spend tokens, often by disguising the approval as a harmless verification, giveaway or checkout step.
How it works
The attacker sends a phishing link or malicious decentralized-app request that prompts the victim to sign an allowance approval or permit. Once the spender has the required authority, it can call token functions such as transferFrom up to the allowed amount, without needing a fresh direct transfer from the victim for each movement.
Technical details worth understanding
Some scams exploit unlimited allowances that remain active long after the original interaction. Signature-based permits and other authorization messages can be abused even when signing costs no gas. Users must inspect the actual token, chain, spender, amount, deadline and application identity rather than trusting interface text.
What can go wrong
Disconnecting a wallet from a website does not automatically revoke an on-chain allowance. A compromised approval may need an on-chain revocation and, in severe cases, migration of remaining assets. Approving a token is not the same as proving identity or receiving a refund.
Practical checks
Teach users to recognize the spender address and allowance scope. A signature prompt presented as 'verify your wallet' can create powerful rights even without an immediate token transfer. Use trusted explorers and wallet tools to review old allowances; disconnecting from a website alone is not the same as revoking contract permission.
Related concepts
Crypto Payment Fraud, Private Key, Webhook Verification.
Further reading
Example
A victim clicks a fake 'claim bonus' page and approves unlimited USDC spending by an unknown address. The attacker later transfers the balance through the allowance. The protective step would have been to reject the authorization and verify the official application's spender address.
Comparison
An approval scam obtains ongoing token spending authority; a seed-phrase phishing scam steals direct key control. Both can drain assets but require different remediation steps.
Key Takeaway
Some scams exploit unlimited allowances that remain active long after the original interaction.
Sources
- How to Revoke Smart Contract Access to Your Crypto Funds — Ethereum Foundation (2026-08-03)
- ERC-20 Token Standard — Ethereum Improvement Proposals (2026-08-03)
- Smart Contract Security Guidelines — Ethereum Foundation (2026-08-03)