TrustDex › Guides › Token impersonation red flags
Token impersonation: name, symbol and metadata red flags
A token's name is whatever its creator typed into a text box. Fakes wearing famous tickers are cheap to make and profitable to sell — here's how to see through them.
Most people identify a token the way they identify a brand: by its name, its ticker and its logo. Token impersonation exists because none of those three things is protected on a blockchain. The impersonator's entire business is the gap between how humans recognize tokens and how chains actually do. This guide walks through the specific tricks — clone floods, lookalike characters, hijacked logos, imposters airdropped straight into wallets — and the single habit that neutralizes every one of them: resolving tokens by address, never by appearance.
Scan the exact address, not the name
Paste a contract or mint address to see what's really behind the ticker.
Metadata is free text, not identity
When someone deploys a token — an SPL mint on Solana, an ERC-20 on an EVM chain — the name and symbol are supplied by the deployer as plain strings. No registry checks them. No rule stops the ten-thousandth token from calling itself "USD Coin" with the symbol "USDC". The chain doesn't know or care that another asset already uses that branding; it only guarantees that the address is unique. Everything a casual buyer looks at first is, technically speaking, decoration.
This is not an oversight that will someday be patched. Permissionless deployment is a core property of these networks, and it necessarily includes the permission to lie in a text field. Token impersonation is therefore a permanent background condition, not a passing scam trend — which means the defense has to live in your process, not in hoping platforms filter every fake.
Clone waves: fakes ride every headline
Impersonators are fastest exactly when buyers are least careful. Within minutes of a hyped launch, an exchange listing rumor, an airdrop announcement or a viral story, dozens of tokens with the anticipated name appear across chains. Some go up before the real one even exists, squatting on a ticker the market is about to search for. The playbook works because early demand is impatient: people race to be first, type the name into a DEX search bar, and buy whichever result has a chart that's already moving — often a fake seeded with a little liquidity precisely so it looks alive.
The tell is timing plus provenance. A token that materialized moments after the news, whose address you cannot trace to an official announcement, is a guess — and in a clone wave, most guesses are traps. If the genuine team hasn't published an address yet, there is nothing legitimate to buy, no matter how many search results insist otherwise.
Lookalike characters and spacing games
Not every fake risks an exact name match, because exact duplicates are easy for platforms to flag. Subtler impersonation edits the name just enough to slip past filters while still fooling the eye. A capital "I" swapped for a lowercase "l". A Cyrillic "а" that renders identically to the Latin letter. A zero standing in for the letter "O". Trailing whitespace, an invisible zero-width character, a ticker with a period appended. On a phone screen, in a small font, at the speed people trade, these edits are effectively invisible.
Unicode gives deployers thousands of glyphs that look like ordinary letters, so "eyeballing the spelling" is not a real defense. If you find yourself squinting at a symbol trying to decide whether it's genuine, you're already playing the impersonator's game — the comparison that settles it is the address, which has no lookalike problem because you verify it by matching characters, not by recognizing a word.
Borrowed logos and fake "official" links
Token metadata usually carries more than a name: an image URI, a project website, social handles. All of it is attacker-controlled. Copying a logo takes one right-click, so a pixel-perfect badge means nothing. More cunning is the social-link trick: the fake token's metadata points at the real project's Twitter and website. A buyer who "does their research" clicks through, lands on the authentic account with its genuine follower count, and comes away reassured — having verified the wrong thing. The links proved the real project exists; they said nothing about whether this particular address belongs to it.
Run the check in the opposite direction and it actually works: start from the official site and see whether it publishes this address. The project's own channels are the source of truth about which token is theirs. A token's metadata is merely a claim about itself, written by whoever stands to profit from your belief in it.
Direction matters: token → links proves nothing, because the token chose the links. Official site → address proves everything, because the team chose the address. Always verify downstream from the source you trust, never upstream from the thing you're doubting.
The imposter that airdrops itself to you
Some fakes skip the search bar and come to you. Because anyone can transfer tokens to any public address, scammers batch-send imposters wearing big-name branding to thousands of wallets at once. The token appears in your balance unbidden, sometimes displaying an eye-catching notional value, often with a URL embedded in its name — "claim at some-site.xyz". The airdrop is the lure; the harvest happens when curiosity takes over: visiting the claim site that phishes your seed phrase, signing a "redeem" transaction that grants a malicious approval, or swapping the thing through a contract designed to fail in your favor's opposite.
An unsolicited token is not a windfall and not a threat while it sits still — it's inert until you interact with it. The correct response is total disinterest: hide it if your wallet allows, never visit anything written in its metadata, and never sign a transaction to realize its supposed worth. Its worth is the transaction it's trying to get you to sign.
Address discipline — and how scanners settle name collisions
Every impersonation trick above — clones, homoglyphs, stolen logos, wallet spam — collapses against the same wall: the impersonator can copy everything about a token except its address. So the discipline is simple to state. Obtain the address from a channel the real team controls: their website, their docs, their pinned announcement. Compare it fully against what your wallet or DEX shows — beginnings and endings can be brute-forced to match, so a first-and-last-four glance is weaker than it feels. Then trade by that address and ignore names entirely. It's slightly slower than typing a ticker into a search box, and it eliminates the whole category.
| Identifier | Can a fake copy it? | Trust it? |
|---|---|---|
| Name / ticker | Freely — it's an unchecked text field | Never alone |
| Logo image | Pixel-perfect, in seconds | Never alone |
| Linked socials | Can point at the real project's accounts | Never alone |
| Contract / mint address | No — unique by construction | Yes, from an official source |
Good tooling encodes address discipline so you don't have to hold it in your head. When a risk scanner accepts a name or ticker, it has to resolve the collision somehow, and the resolution method is worth understanding: reputable tools rank candidates by verifiable substance — verified-list membership, liquidity depth, holder distribution, age — rather than by string match alone, and they show you which address they picked so you can confirm it. Curated registries like Jupiter's verified list on Solana do the heavier lifting: a token earns its badge through review, and wallets and aggregators surface that status, pushing unverified same-name clones down or out of results.
None of this outsources your judgment completely. Verification lags brand-new legitimate tokens and can't vouch for what a team does later. But it collapses the imposter problem from "any of ten thousand text fields might lie to me" down to "does this one specific address check out" — a question a scan answers in seconds. Make that scan the reflex before any first-time buy, and impersonation stops being a way you can lose money.
Confirm the token, then trade it
One paste settles which address is real — then swap it non-custodially if it clears.
Frequently asked
Can two tokens really share the same name and symbol?
Yes. On Solana and every EVM chain, name and symbol are ordinary text fields with no uniqueness check, so hundreds of tokens can all claim the same branding. Only the contract or mint address is unique — which is why serious tools treat the address as the token's actual identity.
Where do I find a project's genuine contract address?
From a channel the team controls: the official website, the docs, or a maintained verified list like Jupiter's on Solana. Copy it from there and compare it character by character with what your wallet shows. Never take an address from a reply, a DM, or a search result sorted by name.
A famous-name token appeared in my wallet — is it real?
Almost certainly not. Anyone can send tokens to any address, and scammers mass-airdrop imposters to bait holders into phishing sites or malicious approvals. Ignore it entirely: don't swap it, don't visit URLs in its name, and never sign anything to "claim" its supposed value.
Why do fakes flood in right after big announcements?
Because demand briefly outruns information. Right after a launch or listing, buyers search by name before the official address has circulated, and scammers deploy clones with the expected ticker to catch that rush. If you can't confirm the address from an official source, waiting costs less than guessing.
Does a polished logo with matching socials prove legitimacy?
No. Logos copy in seconds, and metadata can link to any site or account — including the real project's, so casual clicking appears to confirm the fake. Presentation proves effort, not identity. Only the address, confirmed from the project's own channels, proves identity.