What is Approval scam?

Hey everyone. I really need some help figuring something out.

I've been kicking around the web3 space for about six months now. Nothing crazy. Just buying a little Ethereum, experimenting with decentralized exchanges, and trying desperately to keep my head above water.

Yesterday, my buddy's wallet got entirely drained.

He clicked a sketchy airdrop link on Twitter (I know, I know—total rookie mistake). The wildly terrifying part? He never typed his seed phrase anywhere! He just clicked a button that said "verify," and his entire portfolio evaporated instantly. This sparked a massive panic in our small group chat, leading me down an agonizingly confusing rabbit hole. I keep hitting a brick wall trying to grasp the exact technical mechanics at play here.

So, my main question for you guys is simple: What is Approval scam?

I keep seeing that precise term tossed around constantly on Discord security channels. What is Approval scam? Seriously. I need to know how it physically operates behind the curtain.

From what I can loosely gather, the bad actors trick you into signing a malicious smart contract. You think you're just logging in. Boom. Everything disappears.

I am genuinely trying to piece together a clear, actionable mental model so I don't accidentally nuke my own savings. When newcomers ask, "What is Approval scam?", we need a rock-solid, beginner-friendly answer to point them toward.

My specific friction points:

• Does this nightmare only happen on EVM-compatible networks?
• If I strictly guard my 12-word backup phrase, how on earth do these thieves legally bypass wallet security to swipe the tokens?
• Can someone explain token allowances without using heavy jargon?

I feel completely exposed.

Every single time I interact with a decentralized app now, I'm practically sweating bullets—hovering my mouse over the confirm button like it's a live explosive.

Could someone fill in the blanks for me? I even started tracking the weird differences I noticed before bailing on a sketchy swap site recently:

If anyone has a plain-English breakdown—or better yet, a foolproof routine for revoking weird permissions—I'd owe you big time. We all desperately need to understand: exactly What is Approval scam?, and how do we physically stop it?