You did not buy it and you do not recognize it, yet there it is in your wallet. That is dust. Scammers send these tokens to thousands of addresses at once. The token name or a linked site invites you to claim, swap, or approve it, and that approval is where the trap closes.
The danger is never the dust itself. Holding an unknown token costs nothing and does no harm on its own. The risk starts the moment you interact with it: approving it, swapping it, or visiting the site it advertises. Each of those actions can hand a malicious contract the permission it was fishing for.
The safe move is to do nothing. Hide the token in your wallet interface and never approve or swap it. A wallet carrying dozens of dust tokens has a wider phishing surface than a clean one, which is why a risk check flags heavy dust exposure as a warning even when no money has moved yet.