Scammers now send you a fake Facebook Marketplace listing that shows your name as the seller—bait designed to make you respond fast.
Story Snapshot
- Unsolicited messages use a fake listing that displays your name to spark a reply.
- The profile photo can be stolen from another person with your name, adding fake trust.
- A quick reply confirms your number and can open the door to takeover and fraud, researchers say.
- Meta urges caution on suspicious Marketplace activity, like too-good-to-be-true prices.
How the name-matching lure hooks you
Malwarebytes documented a setup that begins with a short iMessage asking if an item is still for sale, plus an image of a Facebook Marketplace listing that shows the recipient’s own name as the seller. That single twist flips the script. You see your name on the screen, and your brain tries to fix the mix-up. That urge to correct the stranger can make you reply. One answer gives the sender proof your number is live and you are engaged.
The report found the listing image didn’t prove a real, live post existed. The attackers could craft a fake graphic that looks like Marketplace, using your name but someone else’s public profile photo who shares your name. That blend of the familiar and the false is the point. The tactic mimics everyday chatter on local buy-and-sell pages, where quick replies feel normal and harmless. Normal is the camouflage.
Why a simple reply can cost you more than time
Security researchers warn that any reply confirms your number is active and responsive, which boosts its resale value on criminal lists. After that, you may see more lures. Some will try to shift the chat to links, downloads, or “verification” codes. That is where account takeover and malware threats creep in, according to the report, with attackers aiming to grab Facebook access, plant malicious apps, or trick you into sharing sensitive information. One casual text can open several doors at once.
Modern scams work in layers. The first layer lowers your guard. The next adds urgency, like a buyer who “needs it now” or a payment issue that “must be fixed.” The final layer moves you off familiar ground to a link, QR code, or payment platform you do not usually use. Each step seems small. Together, they shift control to the attacker while you try to be helpful and fast.
What we know, what we do not, and what to do
The Malwarebytes report shows the tactic and its likely goals, but does not claim a nationwide count or a running tally of losses tied to this exact ploy. That gap does not change a key fact: impersonation and lookalike tricks sit at the center of today’s fraud playbook. The Federal Trade Commission (FTC) reported that people lost $3.5 billion to imposter scams in 2025, making it the most reported fraud category that year. The numbers explain the stakes even when a single lure seems odd rather than dangerous.
Practical steps help right away. Do not reply to an unsolicited message about a listing you did not post. Do not click links sent by strangers. Check your Facebook account for unknown devices, change your password, and turn on two-factor authentication that uses an app, not text. On Marketplace, stick to on-platform messaging and payments you can track. Meta’s safety guidance flags underpriced items as a red flag; treat identity oddities, off-platform links, and pressure to rush as red flags, too.
Why this tactic works on busy, savvy people
Speed and familiarity move the scam. People scan messages while juggling work, kids, and errands and seeing your own name on a listing slices through doubt. The attacker wants that half-second of trust. The moment you type back, your phone number becomes a confirmed lead. From there, the script can branch into fake payment issues, delivery problems, or a code “to verify you are real.” That last step can let them hijack your accounts if you share codes meant only for you.
#Fake #Facebook Marketplace listing as a #phishing lure https://t.co/7Fp0DDFcVE
— 𝕁𝕠𝕙𝕟 𝕂𝕖𝕟𝕥 (@securiously) October 12, 2026
Conservative common sense applies here: protect your identity, verify before you engage, and keep business on the platform built to record it. Do not reward pushy strangers with your time or your data. If a message feels off, slow down, block, and report. The crooks rely on haste. You win by setting the pace. If you already replied, lock down your accounts today and tell close contacts not to trust odd messages from your number.
Sources:
foxnews.com, malwarebytes.com, consumeraffairs.com, zerohour.day
