EIP-2612 adds permit(owner, spender, value, deadline, v, r, s) to ERC-20 tokens; the owner signs the typed struct Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline) under the token's domain. Permit2 centralizes this: users approve Permit2 once per token, then sign PermitSingle, PermitBatch or signature-transfer messages for each spender, with expiries and nonces.
Because nothing is broadcast when signing, users often do not realize they granted access; drainer kits ask for permit or Permit2 signatures with huge values and far-future deadlines, then submit them. Wallets increasingly decode these messages, and the EIP-712 inspector shows spender, amount and deadline before anyone signs.