We all know nothing is 100% but here are somethings you can look for:

1) Check the team. Do they have legitimate LinkedIn profiles that are publicly available and have endorsements regarding skills?
2) Does their team already have a highly qualified and experienced IT security expert? If not, why on earth not?
3) Does the team have a good spread of technical expertise and marketing skills?
4) Do they have a product yet? If not, how far away is it?
5) What is the demand for their token based off? Do they have a buy-back mechanism? Is the token actually necessary?
6) Do they have a sound consumer acquisition plan for their project?
7) Are they following relevant KYC checks?