A wallet prompt is not always asking you to send a token immediately. It may be asking you to authorise another address to use tokens later. That difference matters because closing the website after the interaction does not necessarily remove an on-chain allowance.
This article explains permission concepts, not whether a token or service is a suitable investment. Interfaces and approval methods vary, so read the actual request in your wallet rather than relying on a screenshot from an older tutorial.
Identify the permission before the amount
Look for the network, token and spender. The spender is the address receiving permission; it is not necessarily the website address visible in your browser. A familiar name displayed by an interface is not proof that the underlying contract is trustworthy.
Ask what action you intended to take and why that action needs access. If the request is unexpected, stop and investigate through independently verified documentation. Do not use a support link supplied by a stranger who contacted you about the prompt.
A spending cap is a boundary, not a guarantee
MetaMask’s spending-cap guidance explains how a user can customise an allowance. A limited cap can reduce the amount a spender is authorised to use, but it does not make a malicious contract safe or prevent every kind of loss.
As an illustrative example, suppose an action requires 20 units of a token but requests access to a much larger balance. The relevant question is why the broader permission is needed. Token units, decimals and displayed values can be confusing; check the wallet’s explanation and official documentation before deciding.
Disconnection and revocation are different
Removing a site’s connection from a wallet interface is not the same as revoking a token allowance on the network. Review permissions through a trusted wallet feature or a verified allowance-management tool. An on-chain revocation may require a transaction and network fee; it is not a reversal of funds already transferred.
Never enter a recovery phrase into a website to review approvals. A legitimate support conversation does not need it. Also be cautious with message signatures: not every request that lacks an obvious transaction fee is harmless.
Keep a record of why a permission was granted and review it when you stop using the service. The useful habit is not clicking through every prompt more slowly. It is recognising what authority the prompt would grant, to whom, and for what purpose.