Phishing in crypto works the same way it does everywhere else — tricking you into handing over something sensitive by impersonating something trustworthy — but the specific techniques are worth understanding, because the damage is instant and irreversible once it happens.
The most direct version is a fake wallet or exchange login page, often reached through a sponsored search ad or a link in a direct message, built to look identical to the real thing. Entering your seed phrase or password there sends it straight to the attacker. The defence is simple but easy to forget under pressure: never type your seed phrase into any website, ever, under any circumstances — no legitimate wallet interface ever asks for it.
A more modern and more dangerous version is the malicious approval request. Instead of asking for your seed phrase directly, a fake dApp prompts your wallet to sign a transaction that looks routine but actually grants the attacker's contract permission to move tokens from your wallet — sometimes immediately, sometimes at a later date the attacker chooses. This is why reading what a transaction is actually requesting, not just clicking "confirm" out of habit, matters every single time, not just the first time.
Clipboard hijacking malware is another variant: software quietly monitors your clipboard, and when it detects you've copied a wallet address, silently swaps it for the attacker's address before you paste it. Always double-check the full destination address after pasting it, especially for larger transfers.
And a simpler but still effective tactic is fake customer support — accounts that reply to your public complaint on social media offering to "help", then move the conversation to direct messages and ask for your seed phrase or remote access to your device. Genuine support teams for reputable platforms don't operate this way, and never need your seed phrase to help with an account issue.