Fake Facebook Marketplace Scam Uses Your Name to Lure You Into Replying

A new text message scam is using fabricated Facebook Marketplace listings that feature the recipient's name as the seller, aiming to prompt a response that can escalate into further phishing attempts. Security researchers at Malwarebytes are alerting the public to this personalized scam that leverages a user's name to create a sense of urgency and personal violation.

The scam begins with a text message inquiring about an item's availability, accompanied by an image that mimics a Facebook Marketplace listing. The deceptive element is the seller's name, which is the recipient's actual name. This detail is designed to immediately raise concern and prompt a reply, such as "That's not me."

Malwarebytes observed that while the seller's name might be accurate, the profile picture used in the fake listing does not belong to the recipient. Investigations revealed the image often belongs to another Facebook user with the same name, suggesting scammers may start with a name and phone number, potentially obtained from data breaches or other sources, to craft convincing fake screenshots.

This tactic is known as a "conversation lure," a method where scammers avoid immediate phishing links or requests for sensitive information. Instead, they create a scenario, like a personalized listing, that encourages the recipient to engage in conversation. The Federal Trade Commission warns that even replying to an unsolicited text can confirm the phone number is active, potentially leading to more scam attempts.

Replying to such messages can provide scammers with valuable information, such as confirmation that the phone number is in use and the recipient is willing to interact. This confirmed number can then be resold or combined with other personal details to craft more sophisticated scams, such as fake delivery alerts or messages impersonating financial institutions.

While the exact motive behind this specific campaign is unclear without engaging the sender, the potential for AI and automation to scale the creation of these personalized lures is a growing concern. Scammers can use AI agents to generate fake listings for numerous individuals if they possess lists of names and phone numbers.

Receiving such a message does not automatically mean a Facebook account has been compromised. The listing is typically fabricated, and the individual's Facebook account remains secure unless credentials have been compromised through other means. Apple advises users to treat suspicious messages as potential scams and to avoid clicking links or providing information. The company offers features within iMessage to filter unknown senders, report spam, and block contacts.

To protect against these scams, experts recommend several steps:

• Do not reply to the text: Even a simple response can confirm your number is active.
• Do not use links or contact information in the message: Verify any information through official channels independently.
• Use strong antivirus software: This can help protect against malicious links and malware.
• Check your Facebook account independently: Log in directly to Facebook to verify any Marketplace activity or account security concerns.
• Report and block suspicious texts: Utilize the reporting and blocking features within your messaging app.
• Secure your Facebook account: If you suspect unauthorized access, change your password immediately and enable two-factor authentication (2FA).
• Reduce publicly available personal information: Be mindful of what information is accessible online through data brokers and people-search sites.

If a user has already replied, the appropriate action depends on the extent of the interaction. A simple reply warrants blocking the sender and reporting the message. If credentials were shared or a security code was given, immediate password changes, account reviews, and security scans are necessary.