Facebook Marketplace Scam Texts Put Your Name on Fake Listings

A buyer question that's really bait

The text comes from a number you don't recognize and asks a routine question: is the item still available? Attached is an image that looks like a Facebook Marketplace listing. If you look closely at the seller field, you'll find your own name. That detail is what makes the scam work.

Security firm Malwarebytes described the scheme on October 6. Researcher Pieter Arntz wrote that Facebook users had reported getting messages with fabricated Marketplace listings that named them as the seller.2 The example the company examined came through Apple's iMessage, opened with "Is this still available for purchase?" and included a fake listing screenshot.2 A week later, the warning had spread through Fox News' CyberGuy column, its syndication partners and several aggregators. Nearly all of them built their reporting on the original Malwarebytes analysis.5133

The scam is low-tech in one sense, because it may never send a link. What it's designed to get is a reply, and that's why the reply is the thing to avoid.

How the lure works

Malwarebytes calls this a "conversation lure." The sender adds a personal detail so the message seems legitimate and gives the recipient a reason to answer.2 The firm argued that the fake screenshot plays on curiosity, worry about your reputation and the urge to correct a mistake. In its view, that combination is likely to get a response such as "That isn't me."2 Fox's coverage put it in plainer terms: seeing your own name makes you wonder whether someone is pretending to be you, and you start typing before you've thought it through.1

The best clue to how the fakes are made came from a mismatch. In the sample Malwarebytes analyzed, the seller's name matched the recipient, but the profile photo didn't. Arntz traced the photo to a different Facebook user with exactly the same name.2 Malwarebytes concluded that the attacker probably started with a phone number linked to a name and built the fake listing from that, apparently grabbing a public profile picture that matched the name rather than the person.2

That matters in practice. The photo error suggests the screenshot was assembled to look believable, not taken from a real listing tied to the recipient's account. Getting one of these texts doesn't mean your Facebook account was hacked. The coverage agrees on this point: a screenshot like this can be made from scratch with no access to your account.1

Why a simple "wrong person" reply matters

All the reporting agrees on the main advice: don't reply, not even to correct the sender. Malwarebytes said that answering a phishing text confirms the number is live. That makes the number more valuable, and it can be sold to other scammers or used for malware, relationship-building fraud or Facebook account takeovers.2 Fox's reporting repeats the Federal Trade Commission's guidance that replying to an unexpected text can confirm a working number and bring more scam calls and messages.1

The Fox piece describes what might follow: a fake delivery notice, a message posing as your bank, an attempt to get a verification code, or a slower conversation meant to earn your trust.1 Several outlets present those as examples of what could happen next, not as steps anyone has documented in this campaign.3

The sources differ on how sure they are about the scam's purpose. Fox's article says the motive behind this campaign is unclear, because finding out would mean engaging with the sender.1 The Arabian Post is the most careful. It notes that researchers haven't shown recipients are being sent to malicious sites, asked for money or targeted for account takeover, and that the evidence doesn't show what happened after the first message. It also says this is about fake screenshots sent by text, not a confirmed flaw in Facebook Marketplace.

Here is my reading. Calling this "phishing" is fair, but it describes the setup more than any confirmed theft. Nobody has publicly traced a full attack from first text to stolen money. Even so, the advice holds up because it doesn't depend on that. Whatever the scammer has planned, it starts with your reply.

The FTC pattern: scams that ask for a reply

This fits a trend federal regulators have already flagged. In an April consumer alert about fake recruiter texts, the FTC said that, as a new twist, scammers were asking people to reply "YES" or "INTERESTED" instead of clicking a link. It told consumers not to engage, however professional the message looked.6 The agency's reasoning was that scammers need you to engage before they can ask for money, through fake check schemes or task scams.6

Malwarebytes followed its Marketplace post on October 13 with a related warning about texts that contain nothing but the recipient's name and a question mark: no link, no payment demand, no images.7 The firm tied that message to the Marketplace lure. It said both rely on name-and-number pairs that may come from breached data traded among criminals, and noted that the FTC has warned about similarly short, harmless-looking openers.7 Taken together, the job texts, the name-only texts and the fake Marketplace listings show the same approach: the first message just has to get you talking.

The FTC's reporting advice applies here too. Fox's coverage cites the agency's recommendation to forward unwanted texts to 7726 (SPAM), which helps wireless carriers find and block similar messages.1

Breached data and cheap personalization

What makes this campaign different is that it's personalized. Malwarebytes argued that hand-making a custom screenshot for each target would once have been too much work for the likely payoff. With an AI agent and a breached list of names and phone numbers, it said, the same thing can now be done fairly easily at scale.2 Several outlets added a caveat: researchers haven't shown that AI made the specific example they looked at, so automation is a plausible explanation, not a proven one.3

The source of the data is also unconfirmed. The Arabian Post reports that no specific breach was identified behind the name and number in the documented case. Malwarebytes notes that cybercriminals buy and sell such data on the dark web.2

The broader point holds even with those gaps. Fox's coverage argues that a text knowing your name tells you very little about whether the sender knows you, because personal details are leaked in breaches, scraped from public sources and traded in criminal markets.1 An accurate personal detail in a message from a stranger should make you more suspicious, not less.1

How this compares with older Marketplace fraud

Most familiar Marketplace scams happen inside a real transaction. In June, Rochester's WHEC reported on a seller who was told a Venmo "business account" payment was on hold and was then asked to send $500 to release it. A Nazareth University technology expert described it as a version of a scam that dates back to Craigslist.10 Guardio's 2026 guide to payment scams lists fake payment confirmations, overpayment refunds and phishing pages posing as seller verification, and stresses that screenshots don't prove anything.9

The name-on-a-listing scam turns that around. It doesn't wait for you to post something for sale. It invents a listing to start a conversation, which means people who have never used Marketplace can be targeted. What the two types share is a fake image meant to stand in for proof. In both cases, the defense is to check through your own app or account, not through whatever the stranger sends you.9

What to do if you get one

The advice is consistent across outlets:

• Don't reply. Even saying "wrong person" confirms the number is active.1
• Don't use anything in the message. Don't tap links, call numbers, scan QR codes or share one-time codes or screenshots of security messages.2
• Check Facebook yourself. Open the app or type the address directly, then review Marketplace activity, recent logins, contact details and recovery settings. Malwarebytes points people who see signs of compromise to facebook.com/hacked.2
• Report real impersonation. If someone really has made a profile pretending to be you, save its URL and report it through Facebook's impersonation process.2
• Use phone-level filters. On iPhone, Messages can move unknown senders into a separate folder, report suspicious iMessages and block numbers. Fox notes that these tools won't catch every personalized attempt.1

If you've already replied, there's no need to panic. CyberGuy's guidance is that replying alone doesn't usually mean you need to change your Facebook password. Entering your credentials on a linked page or sharing a security code does call for quick action: change the password, review active sessions and turn on two-factor authentication.13

The CyberGuy version of the story also promotes a paid data-removal service, which is common in consumer-security coverage.13 The advice behind it still makes sense. Fox notes that removing your details from people-search sites won't undo past breaches but can limit what scammers can easily find.5

Bottom line

No outlet has documented a confirmed loss from this campaign, and it hasn't exposed a flaw in Facebook. It does show that scammers can now make a message look personal cheaply, using a name, a number and a fake screenshot. A message that knows your name and asks for a quick answer is the kind most worth ignoring.