# Security concern

**URL:** <https://community.metamask.io/t/security-concern/31689>\
**Category:** Support\
**Created:** [August 9, 2026, 1:23pm UTC](https://community.metamask.io/t/security-concern/31689 "2026-08-09T13:23:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![obzolende](https://avatars.discourse-cdn.com/v4/letter/o/e47774/32.png) [@obzolende](https://community.metamask.io/u/obzolende)\
**Post date:** [August 9, 2026, 1:23pm UTC](https://community.metamask.io/t/security-concern/31689/1 "2026-08-09T13:23:51Z")

</div>

**Purpose: Security concern**

**Description: Randon:** As a user I am very much concerned and request MetaMask not to pull token randomly from Blockchain but to create a system that pulls only genuine token for user. Pulling randomly is very risky expose Users to Suspicious Tokens. This selection pulling of genuine Token avoid users being scammed. Let this can concern be taken seriously.

---

<div class="post-metadata">

**Author:** ![Oxsoltani](https://dub1.discourse-cdn.com/metamask/user_avatar/community.metamask.io/oxsoltani/32/37719_2.png) [@Oxsoltani](https://community.metamask.io/u/Oxsoltani)\
**Post date:** [August 9, 2026, 2:07pm UTC](https://community.metamask.io/t/security-concern/31689/2 "2026-08-09T14:07:20Z")

</div>

I completely understand the concern, especially for newer users. One important thing to clarify is that MetaMask doesn’t create tokens or randomly decide which tokens exist on a blockchain.

Tokens are created by projects or individuals by deploying smart contracts on the network. Since most blockchain networks are permissionless, anyone can create a token and send it to an address, even if the wallet owner never requested it.

MetaMask can help identify, display, and warn users about potentially suspicious tokens, but it can’t control what other people create on the underlying blockchain.

---

<div class="post-metadata">

**Author:** ![Khaled1](https://dub1.discourse-cdn.com/metamask/user_avatar/community.metamask.io/khaled1/32/39657_2.png) [@Khaled1](https://community.metamask.io/u/Khaled1)\
**Post date:** [August 9, 2026, 8:23pm UTC](https://community.metamask.io/t/security-concern/31689/3 "2026-08-09T20:23:07Z")

</div>

Thank you for flagging this - it’s a valid concern and one we hear often from newer users.

To build on Oxsoltani’s explanation: MetaMask doesn’t create, select, or “pull” tokens onto your wallet. Most blockchains are permissionless by design, so anyone can deploy a token contract and send it directly to any address - including yours.

What MetaMask does to help:

- Enhanced token detection is on by default for new users on EVM networks and Solana, using aggregated community token lists: [How to display tokens in MetaMask | MetaMask Help Center](https://support.metamask.io/manage-crypto/tokens/how-to-display-tokens-in-metamask/)

Unverified token warnings flag tokens that can’t be confirmed by enough trusted sources. This is informational only and doesn’t block transactions.

MetaMask doesn’t maintain an official “approved” token list - verification is probabilistic, not absolute, so user diligence still matters.

> **[What is an unverified token in MetaMask Portfolio? | MetaMask Help Center](https://support.metamask.io/manage-crypto/portfolio/what-is-an-unverified-token-in-metamask-portfolio/)**
>
> What is an unverified token, and how to safely interact with one.

For extra safety, never interact with unfamiliar or airdropped tokens.

If you’d like stricter filtering by default, I’d suggest submitting this as a formal Feature Request.

---

<div class="post-metadata">

**Author:** ![system](https://europe1.discourse-cdn.com/metamask/original/1X/5a52b237b0f337b5837d56bd5cd7b21defb20221.svg) [@system](https://community.metamask.io/u/system)\
**Post date:** [September 8, 2026, 1:24pm UTC](https://community.metamask.io/t/security-concern/31689/4 "2026-09-08T13:24:41Z")

</div>

This topic was automatically closed after 17 days. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![system](https://europe1.discourse-cdn.com/metamask/original/1X/5a52b237b0f337b5837d56bd5cd7b21defb20221.svg) [@system](https://community.metamask.io/u/system)\
**Post date:** [September 8, 2026, 1:24pm UTC](https://community.metamask.io/t/security-concern/31689/5 "2026-09-08T13:24:46Z")

</div>