An unknown NFT with no picture or contract details may be a display issue or an unsolicited asset. Check the public chain record before interacting with it.

A MetaMask user found an unfamiliar NFT under Hidden, with no useful image or contract details, and asked whether it was a scam. Missing details alone do not prove either safety or theft. The first useful split is whether you expected the NFT at all.
Did you expect this NFT?
If it appeared without a purchase, mint, or known transfer, leave it alone. Do not open a URL in its name, image, or description, and do not sign a transaction to “verify” or “claim” it. MetaMask warns that unsolicited NFTs can point to phishing sites and malicious signatures. A blank image is not a reason to connect a wallet somewhere else to reveal it.
If you did expect it, record the network and public wallet address. Search that address on the network's block explorer, then inspect its NFT transfer history for the expected contract and token ID. Do this before trying to import anything into MetaMask. MetaMask's NFT guide explains that the chain record, rather than the wallet thumbnail, is how to verify ownership. Do not confuse your own wallet address with the NFT contract address. If the record shows the token belongs to a different address, changing a display setting will not move it.
For an expected, verified NFT that MetaMask did not detect, the official Extension/Mobile guide shows an Import NFT form with separate network, contract Address, and Token ID fields. The blank official screen below makes the distinction visible; it is not a prompt to import an unsolicited NFT.

Why can the chain show it while MetaMask shows no picture?
MetaMask Extension, Mobile, and MetaMask Portfolio are different views. The Extension and Mobile guide covers NFT detection and manual import using a contract address plus token ID. The Portfolio guide says indexing delays or unsupported image metadata can leave a legitimate NFT missing or without its artwork. Portfolio may separately label an NFT suspicious based on its data providers. A missing picture therefore does not erase a confirmed on-chain asset, while a suspicious label should prompt caution rather than an attempt to bypass it.
The safe conclusion comes from two checks: did you expect this exact contract and token ID, and does the public explorer show it at your address? If both are yes, troubleshoot the relevant MetaMask view. If either is no or unknown, avoid interacting with the NFT and use official MetaMask support if you need help. Never provide a recovery phrase or sign to prove ownership.
Official sources
Product interfaces and recovery policies can change. Confirm the current steps before acting.