Unfamiliar tokens or NFTs in your activity?

Inspect it without following its instructions

Token names, descriptions and NFT images may advertise claim, swap or burn websites. Treat that material as untrusted. Do not connect a wallet or sign something merely to investigate an unexpected asset. MetaMask describes this pattern in its NFT airdrop scam guidance.

Use a public address or the underlying transaction link in Memoir. Public reads do not require a wallet connection. They are not anonymous: the hosting and contacted data providers can see normal request metadata. See Memoir's privacy boundary.

Four things to keep separate

1. Transaction sender. Compare the top-level sender with the address you are inspecting. A different sender means you should not attribute initiation from the token event alone. Delegated and smart-account activity may require more context.
2. Event participants. A token event's From and To fields describe that contract's reported movement, not necessarily who submitted the transaction. An event is not an independent guarantee that the token is genuine.
3. Asset identity and quantity. Check the network, contract and, for an NFT, token ID. Similar names do not establish the same asset. Keep unknown units explicit.
4. Permissions and balances. An approval event, current spending permission and observed balance are different evidence. A dated event alone does not establish today's allowance or prove a theft.

ERC-20 permits zero-value transfers and defines a mechanism for spending on another account's behalf. A zero-value transfer event therefore does not by itself show value leaving a wallet or prove that the wallet holder initiated the transaction. See the ERC-20 standard.

A receipt is not an endorsement: a public example

The Blockscout transaction record, checked on September 20, 2026, lists the sender as an address beginning 0x8A5B2C87 and a token mint event to the address beginning 0xd8dA6BF2. Those are different participants.

That receipt does not establish that the recipient requested the tokens, endorses the project, or can sell them for the displayed value. It also does not prove the token is malicious. Inspect the full addresses and source record before drawing a conclusion.

This is a dated public-index observation, not a claim about the participants' identities or intent. The live result can differ from the observation. The separate frozen sample report illustrates related questions using its own earlier evidence; it does not include this later transaction.

Work through the evidence in Memoir

1. Inspect the individual transaction. Read its execution result and relevant asset or permission events. Use the full source link when a field or interpretation needs verification.
2. Open the related address for context. Review visible activity and named public signals. No matching warning does not mean that every source or contract has been checked.
3. Use filtering as a reading aid. Hiding zero-value or flagged records changes the view, not the chain. Restore the raw view when investigating why a record was excluded.
4. Select evidence deliberately. If you want AI help, review the chosen records and facts. Memoir analyzes that frozen selection and its limits, not every transaction the address has ever made.

For a specific balance difference, use Check a balance. A current holding, an indexed event and a historical balance check answer different questions; missing coverage can leave the result unresolved.

When the question is more serious than an unfamiliar record

If you find an unexpected transfer of an asset you recognize or a permission you cannot explain, do not dismiss it as spam merely because other records are noisy. Preserve the transaction evidence and consult your wallet's official security guidance through a trusted channel. Do not follow recovery offers or support links supplied in the suspicious asset.

Memoir cannot certify a wallet as uncompromised or recover assets. It can help separate observations from assumptions. Never submit a seed phrase, private key or account login as part of a lookup or feedback message.

Related checks

Expecting a payment instead? Read transaction successful but not received. For named risk signals and their limits, read how to check a wallet address.