The signature that lets a contract spend your tokens is convenient by design — and it is exactly what a fake 'claim your reward' page is built to collect.
Scammers seed your transaction history with look-alike addresses so that one careless copy-paste sends real money to them — and the usual check won't catch it.