They say that you need to enter your secret phrase in their wallet to get tokens.
AFAIK, legitimate forks will also require you to put your private key to claims their tokens on their wallet (if you don't use exchange to handle the fork). But scam forks will require you to put your private key upfront, before they even begin their distribution. Also, you need to make sure that there is no malicious code on the wallet where it is possible for the team to get your private key when you use it.
ETCV use the exact strategy, require people to put or use their wallet where they can record/know their private key when they connect it to the network IIRC.
