if the airdropped token is a security token, then it's illegal. And since this a gray/developing area every token has a high chance of being classified as a sec

if the airdropped token is a security token, then it's illegal. And since this a gray/developing area every token has a high chance of being classified as a security token. This also may result in unwanted tax and other liabilities on the receiver's side. It's a flaw in Push payments design. Either receiver need to confirm tx or use a design based on Pull payments.