Recently, numerous users have inquired: “Under the pretense of offering discounted PetroChina fuel cards, an individual requests a zero-value transfer while requiring me to enable advanced mode and input a series of digits in the Data field, purportedly to verify the functionality of my wallet address. Does this pose any risk to my wallet's security?”
imToken: This represents the latest scheme swindlers employ to steal token transfer allowances—don’t be deceived! Stay ahead of fraudsters by reading this insightful article. It delves into the intricacies of their schemes and offers expert tips to help you stay safe.
The Data feature serves as a bespoke information functionality within the Ethereum network, enabling the invocation of smart contracts or recording information on the blockchain during a transfer.
In the scenario above, the swindler claims to use a zero-value transaction to assess wallet functionality. But which smart contract is actually invoked? A closer examination of the transaction ID from the blockchain reveals that this is an authorization (approval) transaction. The user unknowingly permits a USDT transfer to the recipient, who doubles up as a deceiver. Armed with the transfer authority, the fraudster can abscond with the user’s assets without their consent, while maintaining an air of blockchain sophistication.
Originating from previous authorization scams, which enticed individuals to give authorization via DApps, this scheme involves swindlers deceiving users into entering specific data during transactions to achieve the desired authorization effect.
The imToken security team has your back – read their expert advice to protect your digital assets:
- Beware of fraudsters who employ various pretexts, such as purchasing U / testing USDT / mining, to lure you into using the Data feature for transfers. Refrain from executing such transactions at all costs!
- If you have already approved such requests, you can promptly revoke them by following the steps outlined in this article https://support.token.im/hc/en-us/articles/900006746566-My-USDT-was-sent-out-from-my-wallet-without-my-consent-How-did-that-happen-.Besides, you can type "Revoke" on the imToken browser to access the Revoke.cash DApp, and nullify wallet authorizations across all networks, including Ethereum, Arbitrum, BSC, Polygon, and Avalanche.
Note: Don't let uncertainty and deception get the better of you – seek expert assistance from imToken's official customer service via the "Support and Feedback" section within the app.