Sending tokens costs almost nothing, so scammers airdrop worthless tokens to hundreds of thousands of wallets. The token's name is a URL: 'Claim2000USDC-site.com'. The token is not the theft. The site in its name is.
What lands in the wallet
Received: 1,999 USDCLAIM-rewards.net
From: 9xF3...k2Qp (unknown)
Your action so far: None
Receiving is harmless
Anyone can send anything to any address — yours included. An unsolicited token sitting in your wallet has no power. It cannot drain you, watch you, or 'infect' anything. It is a flyer under your windshield wiper.
Visiting is not
The URL leads to a claim site — a drainer funnel with your 'reward' as the bait. Interacting with the token or its site is the only way it becomes dangerous.
Nobody pays to give strangers money
Real airdrops never need a claim site you have never heard of. Ask what the sender gains — mass-mailing tokens costs money, and nobody pays to give strangers $2,000.
Where this goes next
Selling a token somebody sent you is its own trap. Two later lessons show exactly how that sell gets blocked, or taxed.