Before buying a token, verify the contract isn't a scam. Checks for honeypot behavior, hidden ownership, mint functions, and verifies contract source is public. Also checks the deployer wallet for fraud history and the project's domain reputation.