They have link in shops that show paintbrushes for one np. you click on it and it redirects you to a website that looks almost identical to neopet but you're logged out.
Then link is rz.neopet.com
or something like that.
Then you login, viola, your info got stolen.
JK. I'm not sure if that's how you get cged but that's one scam to watch out for.