Tokens that you did not buy

Scammers send free tokens to many wallets. The token name can tell you to visit a website to claim a reward. Do not visit the site and do not interact with the token. It cannot take funds from you if you ignore it.

Small transfers from an address that looks like yours

This is called address poisoning. The scammer hopes that you copy their address from your history. Always copy an address from the source (for example your exchange's deposit screen), not from your transaction history.

A transaction that you did not make

Look at the transaction on a block explorer.
If funds left your wallet without your approval, withdraw the remaining funds to a new wallet that you control.
Contact support with your wallet address and the transaction hash.

Related: Scams and phishing