Good question and we already thought of that: the token itself includes information on how to reach the mint it is from.

A wallet should then ask you if you want to trust that mint before you accept the token.