Electrum version 4.8.3 checks signatures only on wallet-owned inputs, leaving unconfirmed incoming transactions unchecked because the client lacks a full script interpreter

From the articleRogue Electrum servers swap real payments for zero-fee fakes