A permit grants spending permission through an off-chain signature — no gas, no transaction, and often no warning from your wallet.
Most people have internalised a rule that is almost right: transactions are dangerous, signatures are harmless. Signing in to a site with your wallet really is harmless. That rule is what permit scams exploit.
A permit is an approval that travels as a signature instead of a transaction. You sign a structured message; the other party submits it on-chain later, paying the gas themselves. The end result is identical to an approval — they can spend your tokens — but the path there looks nothing like one.
Because it is not a transaction, it costs you no gas, needs no confirmation dialog about spending, and leaves no trace in your transaction history at the moment you sign. Some wallets show little more than a wall of fields. Nothing flashes red.
Permit2, used widely across Uniswap and other major protocols, works on the same principle and is entirely legitimate. Again the honest and the fraudulent version look alike.
What to check: the `spender` field is who you are handing permission to, and the `deadline` is how long it lasts. A deadline decades in the future on a signature you expected to be a login is a reason to stop.
Check a transaction of your ownPaste anything. It is decoded in your browser.