They will now ask you password directly. They will ask you to signup for and update profile on their website (I am talking about trustless token airdrops). You will signup with an email and password. They may also ask for mobile number for OTP.
Now with this email and password that you used with signup, they will try to login on different exchange. If anyone using same email password as his exchnage email id and password, your fund will be in blackhole.
Now with this email and password that you used with signup, they will try to login on different exchange. If anyone using same email password as his exchnage email id and password, your fund will be in blackhole.
I honestly never considered that these guys could be storing passwords in plaintext form. If this were the case, even if the exchange had the integrity to not mess with your data, they're a hack away from all of your accounts being compromised. Definitely use unique passwords on everything.
Another thing to consider is that the overwhelming majority of these are scams, so it's usually not worth it to give them sensitive data when they ask for it. Don't risk thousands for a few pennies.