Anyone can create a token with any name and symbol they like — including one that copies a popular, legitimate project exactly. The only reliable way to know you're holding or trading the genuine article is to verify the contract address itself, not just the name shown in an app or search result.
Start at the source: the project's own official website, documentation, or verified social media account should publish its real contract address. Copy it from there directly, rather than trusting whatever a wallet's search function or a third-party site surfaces first — fake tokens routinely copy a real project's name, logo, and symbol exactly.
A block explorer (the tool for the relevant network — for example Etherscan for Ethereum) lets you look up that address directly and see whether the contract is "verified", meaning its source code has been published and matches what's actually deployed. An unverified contract isn't automatically a scam, but it does mean you can't independently inspect what it actually does, which is a meaningfully higher-risk position to be in.
Watch out for address poisoning too: scammers sometimes create a wallet address that looks similar to one you've transacted with before — matching the first and last few characters, which is often all people glance at — then send a tiny, unsolicited transaction from it, hoping you'll copy it from your transaction history by mistake later. Always verify a full address character by character for any transaction that matters, not just the start and end.
Checking a contract address takes a couple of minutes. Losing funds to a fake token takes seconds and is permanent. The asymmetry is the entire argument for making this a habit, not an occasional precaution.