I received an unexpected NFT or digital token in my wallet — is it a scam?

Airdrop phishing involves sending a fraudulent NFT or token directly to your crypto wallet without your consent. The asset may appear valuable or intriguing. When you try to view it, sell it, or interact with it through a connected marketplace, the transaction you approve — often embedded in the action of viewing or claiming — grants the scammer permission to transfer your real assets. Some malicious NFTs contain code that executes when you interact with them. The safest response is to simply not interact with any NFT or token you did not purchase or explicitly claim. In many wallets, you can hide or burn unwanted tokens without approving any on-chain transaction that could grant permissions.

The underlying design fact that makes this scam possible is that anyone can send anything to a public wallet address — receipt implies nothing about value or intent, any more than junk mail implies a genuine prize. The danger is concentrated entirely in interaction, and especially in the approval step: a signature that feels like viewing your item can, in the contract's actual terms, be permission for another address to move your tokens. Cultivating a flat rule — unexpected assets are left untouched, and every signature request is read as a permission grant until proven otherwise — removes the attack surface entirely.