[lordnacho]

An NFT is basically a number in a smart contract. Through the ERC721 (there are others) interface, you can ask the smart contract which address owns that particular number. So, "contract 0xdeadbeef... , who owns 123456 ? It's owned by 0xabcdef..."

This is totally fine, but keep in mind someone could deploy an identical contract to a different address, which also has a 123456 in it, which is also owned by 0xabcdef. You'd have to be careful when you're checking the ownership that you're checking everything. I could imagine an unscrupulous person saying "Look, I sent you 123456, it's in your address, see?" and then absconding.