Two Token-2022 extensions change what happens every time a token moves.
The transferFeeConfig extension takes a fee on each transfer, set in basis points (100 basis points is 1%) with a maximum per transfer.
Example: at 50 basis points, sending 1,000 tokens delivers 995 and withholds 5.
The transferHook extension names a program that Token-2022 calls on every transfer. The hook can run its own checks, such as an allowlist or a royalty, and can block the transfer by failing.
A hook is only as trustworthy as its program. If that program is upgradeable, whoever holds the upgrade authority can change the rules later; see upgradeable programs.
PYUSD carries both extensions. Its token page shows their current settings: the fee in basis points, and the hook program when one is set.
Token pages here list every extension a mint carries. A nonzero transfer fee and a set hook program are called out, so you can see them before you buy.
Related: permanent delegate.