Fake NFT Listings and Stolen Item Flags on Marketplaces

2026-09-03

A marketplace page shows you a name, a picture, a collection, and sometimes a warning label saying the item was reported stolen. None of those four is a fact the blockchain records. The chain records which contract holds which token ID and who owns it right now; everything else on the page is a claim made by the marketplace or by whoever minted the item. Reading a listing safely comes down to separating the two.

Fake NFT Listings and Stolen Item Flags on Marketplaces: key points at a glance

What a marketplace listing actually is

A listing is an offer to sell on stated terms, and in the signed-order design it is a message rather than a transaction. The seller keeps the item, signs the terms with their wallet, and the marketplace stores that signature. The token moves only when a buyer submits a transaction that fulfils the offer. EIP-712, the Ethereum standard for hashing and signing typed structured data, was written for this pattern: its stated aim is to improve the usability of off-chain message signing for use on-chain, because doing so saves gas and reduces the number of transactions on the blockchain.

Two consequences follow from the offer living off-chain. A marketplace can display a listing, hide it, or refuse to serve it, and none of those acts touches the token. And because fulfilment has to move the item out of the seller's wallet, the seller must have granted the marketplace's contract permission in advance, which is an ordinary token approval of the kind ERC-721 describes as enabling an operator to manage all of the caller's assets.

Why a convincing fake costs almost nothing

Minting is open. Anyone can deploy a contract that follows the same token standard as an established collection, give it the same name and symbol, point every item at the same images, and mint 10,000 of them. Nothing in the standard prevents that, because the standard defines how a token transfers and who owns it and says nothing about what a token is allowed to depict.

That is where the uniqueness of NFTs has to be stated precisely. The token is unique: ERC-721 identifies every NFT by a unique uint256 ID inside its own contract, and that entry cannot be duplicated or subdivided. The picture the entry points at has no such protection. Uniqueness is a property of the ledger entry, not of the artwork.

Metadata is what makes the copy cheap. Under the metadata extension, tokenURI returns a distinct Uniform Resource Identifier for a given asset, and the standard notes that the URI may point to a JSON file conforming to the ERC721 Metadata JSON Schema. A URI is a pointer. Two different contracts can point at the same file, and whoever controls the destination can change what sits there afterwards.

The one identifier that cannot be copied

The contract address is the part a copy cannot take. ERC-721 states that the pair of contract address and token ID is a globally unique and fully-qualified identifier for a specific asset on an Ethereum chain. Two collections can share a name, a symbol, and every image; they cannot share an address.

So the check that settles a fake listing is not a visual one. Take the contract address from the listing and compare it character by character against the address the project publishes on a channel you reached yourself. If they differ, the item in front of you belongs to a different collection, whatever the page says above it.

Interface detection does not close that gap. ERC-165 creates a standard method to publish and detect what interfaces a smart contract implements, and a caller can invoke supportsInterface to determine whether a contract implements an interface it can use. That tells you the contract behaves like an NFT contract. It does not tell you the contract is the one you meant.

What a verified badge is and is not

A badge is an attestation by the marketplace. It says an account or a collection satisfied whatever review that marketplace runs, which makes it a statement about the marketplace's own records: granted by that venue, applicable on that venue, and removable by that venue.

The badge therefore does not travel. The same contract can carry a badge on one venue and none on another, and the token is identical in both cases, because nothing about a badge is written to the chain. Read it as one input among several and keep the address comparison as the one that decides.

Badges also invite impersonation of their own. A screenshot of a badge, a collection name with one character swapped, or a profile that mirrors a real account are all cheaper to produce than a badge is to obtain, and they work on anyone who stops reading at the badge.

What a stolen item flag is and what it stops

A flag is a note in a marketplace's own database, attached after somebody reported that an item was taken from them. That report is a claim made by a person, and the flag records that the claim was received and accepted for review, not that any court has decided anything.

The chain has no equivalent field. The interface ERC-721 defines covers balances, ownership, transfers, and approvals, and it stops there: the function ownerOf answers who holds a token, and no function answers how they came to hold it. Blocking is not part of that interface either. The specification says an implementation may throw in other situations and gives blocklisting an address from receiving NFTs as one such optional choice, which puts that decision inside a particular contract rather than in the standard every collection shares.

That gap decides what a flag can do. On its own surfaces a marketplace can hide the item, disable buying and selling, and warn anyone who opens the page. Beyond those surfaces it has no lever: the owner can still call transferFrom, another venue keeps separate records and may show the same item as ordinary, and the flag does not return the item to the person who lost it. If a transfer is ever blocked at the contract level, that is the collection's own code acting and not the marketplace's flag.

Two situations follow from that. If you hold a flagged item, your recourse runs through the marketplace's own appeal process, because the flag lives with the marketplace. If you are about to buy one, understand what you would be holding: an item the chain says is yours and the venue you bought it on will not let you resell.

Question about an item	Where the answer is kept	Travels with the token
Who owns it right now	The contract, through ownerOf	Yes
Which contract and token ID it is	The chain itself	Yes
Whether the collection is the official one	The marketplace's own records	No
Whether it was reported stolen	The marketplace's own records	No
Whether you are allowed to trade it here	The marketplace's own policy	No

The listing that is really a signature request

Some fake listings are not selling anything. The page exists to put a signing prompt in front of you, and the prompt asks for an approval over your collection rather than for a purchase. Sign it and the counterparty can move every item that approval covers, which is the mechanism behind a wallet drainer.

The history of the signing standard explains why this is hard to catch by eye. EIP-712 was written because signed messages had been an opaque hex string displayed to the user with little context about the items that make up the message. Structured signing improved that, and it also handed a scam a legitimate-looking envelope, so the safeguard is reading the decoded contents instead of trusting the shape of the prompt.

Two habits cut this down. Reach a marketplace through an address you saved yourself rather than a link that arrived, and read what the prompt authorizes: a purchase costs money and moves one token, while an approval costs nothing at signing time and grants standing permission over many.

Checking a listing before you buy

What to check	What to compare it against	What a mismatch tells you
Contract address	The address the project publishes itself	A different collection, whatever the name says
Token ID	The item you believe you are buying	The listing points at another item
Metadata and image	The files the collection publishes	The picture is borrowed, not owned
The signing prompt	The action you intended	You are approving access, not buying
Trading status on the venue	Whether a report is attached to the item	Resale on that venue may be blocked

Order matters here. The address comparison comes first because it is the only line grounded on the chain, while every other line is a record held by somebody. Run it before you look at the price, the rarity, or how much time the page says is left.

The bottom line

A marketplace page mixes two kinds of statement. The chain contributes a small verifiable set: which contract, which token ID, and who owns it now. The marketplace contributes the rest, including collection names, badges, and any stolen item flag, and all of that is its own record rather than a property of the token.

Fake listings work on the first mixture, copying everything that is free to copy and counting on you never checking the address. Flags belong to the second: real information, held by one venue, with no reach over the chain or over other venues. Compare the contract address before anything else, read what a prompt asks you to sign, and treat a flag as a signal about one marketplace's records instead of a verdict on the item. To keep learning the fundamentals, follow more from Bitbase Academy.