Token spoofing is like when someone pretends to be Vitalik Buterin and sends illegitimate tokens to illegitimate contract. It’s like getting an email from me@vitalik.ca but it’s not actually from him. Using this method, scammers are trying to prove their legitimacy by associating with reputable individuals.
Spoof transfer is performed by using the “transferFrom” function in the contract and changing the sender’s wallet address to say, Buterin’s address.
Often, the contract address is the ONLY way to distinguish between the real and spoof transfer.