[ChrisClark]

The people being scammed here aren't looking at what they are doing, at all.

They go to the website, click "mint NFT", then their wallet pops up and says, "Sending [your expensive NFT] to [address], confirm?"

And then the user says, yeah, I want to send them my NFT.

There are more subtle ways to scam though. But the people losing them here are the type of users that confirm everything without reading.

[IanCal]

Signing transactions used to iirc just show hard to interpret bytes. The user is not executing the transaction.

[rattlesnakedave]

Metamask presents a large red warning when a user is prompted to sign a raw transaction, and they’re planning on deprecating that part of the API, so hopefully that helps.