I never confirmed any transfers, so why were my tokens still taken?
My understanding: An offline signature leaves no on-chain record until it is submitted on-chain, so authorization management tools often can't see it.
This kind of signature is not itself an on-chain transaction, and signing doesn't cost Gas. But whoever obtains the signature can submit it on-chain to make the authorization effective.
What I do: Before signing, I check the authorized party's address and the authorization amount. If I don't recognize the address or the amount seems unusual, I reject it.
Price at this moment: $ETH Current price 2235.01, 24h -0.32%.

Opinions are for discussion only. Use at your own risk.