A signature request that costs nothing and touches no blockchain still looks harmless to most users. Some of those signatures are instructions that a contract will execute later.
Two things a wallet can be asked to sign
A transaction is submitted to the network, costs a fee and changes state immediately. A message is signed locally and handed back to whoever requested it.
Signing a message produces a piece of data that proves a specific account approved specific content. Nothing is broadcast, and the wallet shows no pending activity.
The absence of a fee makes the second kind feel like a login step. That impression is the source of most of the trouble.
Structured signatures carry executable terms
Modern standards let a message be a typed object with named fields, so a signature can encode a spending permission or an order with a price and an expiry.
The counterparty submits that signed object to a contract whenever they choose, and the contract verifies the signature and acts. The user pays no fee, which is the design goal.
The signature is therefore a bearer instrument. Once it exists, whoever holds it can use it under whatever terms it contains, until it expires or is revoked.
Where the terms get hidden
A wallet can only display what it can parse. Poorly labeled fields, unfamiliar formats or a raw hash reduce the confirmation screen to characters with no meaning.
Hardware devices with small screens make this worse, since a long structured message must be paged through and the crucial field is easy to skip.
Fraudulent sites exploit exactly this gap by presenting a routine-looking connect-and-sign flow whose payload approves a transfer of the account's most valuable holdings.
Why permissions outlive the moment
Signed permissions typically include an amount and a deadline, and both are set by whoever drafted the request rather than by the wallet.
A generous amount with a distant deadline sits available for months, so a signature given during one interaction can be used long after that site is forgotten.
Revocation depends on the specific standard. Some can be canceled by advancing an on-chain counter, which costs a fee and must be done deliberately.
What careful signing looks like
The habit worth building is reading the domain the request claims to come from and the fields naming a token, an amount and a spender before approving anything.
Separating accounts helps more than vigilance does. A wallet used for experimentation holds nothing that a bad signature could meaningfully take.
The underlying point is that signing is authorization, not identification. Treating it as a login is what converts a free click into a transfer.