A transfer you never made can appear in your history, even one that looks like it came from you. Here is how, and why it matters.
The ERC-20 token standard says that transfers of 0 must be treated as normal transfers and must fire the Transfer event. Moving nothing needs no permission, so an attacker can make a real stablecoin contract record a 0 transfer between you and their lookalike address. Your wallet then shows a real-looking USDC or USDT line with the lookalike in it.
An attacker can also deploy their own token contract and give it any name and symbol. A token contract decides for itself which Transfer events it emits, so a fake token can record a “transfer” of any amount, from any address to any address, including from you, without your signature. Attackers copy the exact amount of your last real payment, so the fake line sits right next to the real one.
To beat filters, the names are disguised: letters from other alphabets that look like Latin ones (a Cyrillic “С” instead of a Latin “C”), invisible characters between letters, or dotted look-alikes. Unicode's own security standard calls such strings confusable. On Base we flagged 926 fake token contracts used this way in the first weeks of watching, most of them in October 2026.
The fake transfer itself takes nothing from you. Its only job is to put a lookalike address in your history. The loss happens later, when you copy that address and send real money. See what address poisoning is for the full pattern.