Scammers Fake Facebook Marketplace Listings Using Your Own Name

Imagine getting a text from an unknown number asking a simple question: "Is this still available for purchase?" An image attached shows what looks like a Facebook Marketplace post. Maybe you feel confused because you sold nothing recently. Then you check the seller's name. It matches yours. That tiny detail might make you type back, "That's not me." And that reply is exactly what the person behind the message wants.

Security researchers at Malwarebytes are sounding the alarm about a personalized text scam that fakes Facebook Marketplace listings using the recipient's own name as the seller. The message can spark instant fear that someone is impersonating you online. Here is how this trick works and what to do if such a text hits your phone.

Join us for a free CyberGuy LIVE class where Kurt "CyberGuy" Knutsson shares practical ways to stay safer, smarter and more confident with technology. Explore classes on stopping spam, phone security, financial protection and using AI to get better healthcare. Each class is free, easy to follow and comes with a free printable checklist. See the classes and register at CyberGuyLive.com.

THE SECRET LIST THAT TELLS SCAMMERS YOU'RE AN EASY TARGET

How the fake Facebook Marketplace listing works Malwarebytes analyzed an example sent through iMessage. The text asked whether an item was still available and included an image resembling a Facebook Marketplace listing. The clever part appears when you look at the supposed seller. The recipient's real name is there.

However, Malwarebytes noticed something strange. The profile photo did not belong to the recipient. Researchers traced the picture to another Facebook user who happened to have the same name.

That suggests the scammer may have started with a name and matching phone number. Those details could potentially come from breached data or another source. The attacker could then use the name to build a convincing fake Marketplace screenshot. Seeing your name creates an obvious question: "Is someone pretending to be me?" Before you know it, you're typing a reply.

Why scammers want you to respond This technique is known as a conversation lure. Instead of immediately asking for a password or sending an obvious phishing link, the sender gives you a reason to start talking. In this case, the lure feels personal. Someone apparently put your name on a Marketplace listing. You may want to correct the buyer or find out what happened. You might also worry that someone has created a fake Facebook account in your name.

The exact motive behind this particular campaign remains unclear because determining the next step would require engaging with the sender. Still, replying to suspicious texts carries its own risk. The Federal Trade Commission warns that even replying to an unexpected text can confirm that a scammer has reached a working telephone number. That could lead to more scam calls and texts.

Your reply may tell scammers more than you realize Think about how harmless a response such as "wrong person" feels. You haven't shared a password or sent money. You haven't clicked a suspicious website. However, you've given the sender something useful: confirmation that someone is actively using the number and willing to respond. Malwarebytes reports that a live number can become more valuable to scammers and potentially be resold to others. The number could also be combined with additional information gathered from public profiles, breached databases or other sources. That can help set up another scam.

You might later receive a fake delivery alert. Another message could pretend to come from your bank. A scammer might eventually try to steal a verification code, direct you to a malicious site or build a longer conversation designed to gain your trust. We recently looked at what a scammer can do with your name, phone number and address.

Personal details become dangerous tools when criminals stitch them together with other stolen data. Artificial intelligence could make personalized scams easier to scale than ever before. Malwarebytes warns that an attacker holding a list of names and phone numbers might use an AI agent to craft tailored lures at massive volume. Researchers have not confirmed that AI built the specific example they studied, yet automation drastically lowers the effort needed for this kind of personalization.

This marks a major shift in how we must judge suspicious messages. A text knowing your name offers little reassurance that the sender actually knows you. Personal information leaks through breaches, gets scraped from public sources, and trades hands in criminal marketplaces. Once scammers connect a few pieces, they can make a random message feel surprisingly personal.

Does this mean your Facebook account was hacked? No. Seeing your name on one of these fake Marketplace images does not, by itself, prove someone accessed your Facebook account. The Marketplace screenshot may simply be fabricated. You should resist the urge to reply to the sender asking what is going on. Instead, check Facebook yourself.

Apple says this type of deceptive messaging uses social engineering. Scammers rely on impersonation and manipulation to persuade people to share personal information. Criminals may pretend to represent a trusted company or organization while trying to obtain passwords, security codes, or financial details.

Apple also points to an important iMessage protection. By default, users cannot open links sent by an unknown iMessage sender until they add that person to their contacts or reply to the message. That gives you another reason to avoid responding to an unexpected text. Apple recommends treating suspicious, unexpected messages as potential scams and contacting the company directly through a trusted channel. The company also says users can filter unknown senders, report suspicious messages, and block unwanted contacts through Messages.

Apple's Messages app includes tools to help filter unwanted texts, report suspicious messages, and block senders. Since this Facebook Marketplace scam arrives through iMessage, here is how you use those protections on an iPhone. Turn on screening for unknown senders by opening the Messages app, tapping the Filter button in the conversation list, then tapping Manage Filtering. You must turn on Screen Unknown Senders. To control alerts, tap Allow Notifications and select which categories of unknown messages can notify you. Messages from unknown senders will appear in a separate folder instead of your main conversation list. Apple says you won't receive notifications for these messages unless you've chosen to allow certain categories of unknown messages.

SCAMMERS KNOW THE BEST TIME TO TEXT YOU

Report a suspicious iMessage by opening Messages and finding the suspicious conversation. Haven't opened the conversation? Swipe left, tap the Delete button, then tap Delete and Report Spam. Already opened it? Tap Report Spam at the bottom of the conversation, then tap Delete and Report Spam. Apple says reporting an iMessage sends the sender's information and message content to Apple. The message is then permanently deleted from your iPhone. However, reporting does not automatically block the sender, so follow the blocking steps below. If you have already replied, the reporting option may no longer be available.

When an SMS, MMS, or RCS message lacks a reporting button, Apple suggests reaching out to your wireless carrier directly for help. To stop a scammer in their tracks on an iPhone, open the Messages app and select the suspicious conversation. Tap the sender's icon at the top, then choose Info. Scroll down until you see Block Contact and tap it. This action stops messages from that number from ever reaching your phone again. The person trying to fool you will not get a notification telling them they have been blocked.

You should also scan for messages Apple has already marked as spam. Open Messages, hit the Filter button, and select Spam to review what got caught there. If a legitimate message ends up in that pile, open it, tap Not Spam, then Move to Messages. Spam filtering turns on by default, but you can check its status under Filter > Manage Filtering > Filter Spam if needed. Keep in mind these protections lower your risk of exposure to scam messages, yet they cannot promise to catch every personalized phishing attempt. Do not reply to a suspicious Marketplace message just because it includes your real name.

A text like this is built to make you react fast. Instead, pause and investigate through channels you trust. First, do not reply to the text. Even telling the sender that they have the wrong person confirms that someone is actively using that number. The FTC advises avoiding replies to unexpected messages from unknown numbers entirely. Second, ignore any links or contact details inside the message. Do not click a link, call a number, or scan a QR code provided in the conversation. Never send a one-time security code or a screenshot containing sensitive info back to them. If you must check Facebook, open the app yourself or type the address directly into your browser.

Third, install strong antivirus software. This tool helps protect you if a scammer manages to send a malicious link or tries to trick you into downloading malware. It can also warn you about dangerous websites before they cause trouble. The best defense against malicious links that install malware and potentially steal your private information is to have antivirus software running on all your devices. This protection also alerts you to phishing emails and ransomware scams, keeping your personal data and digital assets safe. You can find my picks for the best 2026 antivirus protection winners for Windows, Mac, Android, and iOS at CyberGuy.com.

Why does this matter? Because verified social media accounts can still lead you into a scam if someone else controls them. Fourth, check your Facebook account independently. Open Facebook and review your Marketplace activity and messages. Look for anything you did not post or send. You should also review your account security for unfamiliar logins, changed contact information, or other activity you do not recognize. Fifth, verify with a known sender through another method. If a suspicious message seems to come from someone you actually know, contact that person via a different channel. For example, call a number you already have saved rather than using contact details supplied in the suspicious text.

Sixth, report and block suspicious texts. On an iPhone, follow the reporting and blocking steps described above. Android users can use their messaging app's built-in spam reporting and blocking features. The FTC also recommends forwarding unwanted texts to 7726 (SPAM). These reports help wireless providers identify and block similar messages from spreading. Seventh, report a Facebook impersonator if you find someone has created a profile pretending to be you. Preserve the profile's URL and report it to Facebook. A fake screenshot alone does not prove that an impersonating Facebook profile actually exists. Check Facebook independently before assuming someone has created one. Eighth, secure your Facebook account immediately if something looks wrong. If you discover an unfamiliar login, changed account information, or other evidence of unauthorized access, start Facebook's account recovery process right away.

Facebook users should double-check their passwords and turn on two-factor authentication right now. The platform currently hides these settings under Accounts Center, then Password and security, followed by Two-factor authentication. This simple step adds a critical layer of defense against unauthorized access attempts.

9) Reduce the personal information scammers can find This specific scam proves how dangerous exposed data becomes in criminal hands. Your name and phone number might already live on people-search sites or deep inside data-broker databases. Deleting that info won't erase records from past breaches, but it stops attackers from easily finding details to personalize future attacks. No service promises total removal of all your data from the internet, yet a data removal tool can monitor hundreds of locations and automate cleanup over time. Readers can check top picks for these services or get a free scan at CyberGuy.com to see if their info is already online.

What if you already replied? Do not assume one reply means your phone or Facebook account has been compromised. A single message response does not give someone access to your login details. The next steps depend entirely on how far the interaction went before you realized it was a trick. If you only replied to the text, stop the conversation and block the sender immediately. Report the message if your messaging app still offers that option and stay cautious about unexpected texts or calls arriving afterward. You generally do not need to change your Facebook password just because you responded.

Clicking a suspicious link and entering credentials changes everything completely. Change your Facebook password immediately through the legitimate app or website without delay. Next, review your account for unauthorized activity and turn on two-factor authentication if you have not already done so. Sharing a one-time security code requires even faster action. Go directly to the affected account, change the password, review security settings, and check active sessions right away. Use a password manager to create and store strong, unique passwords that are not used anywhere else. Downloading a file or app means stopping all contact with the sender immediately. Run a security scan using strong antivirus software and remove anything downloaded from the suspicious message. Watch for unusual activity on your device after cleaning up the mess.

Kurt's key takeaways The personal detail makes this scam so convincing to unsuspecting victims. You see your own name on a Marketplace listing you never created, which naturally sparks curiosity about what is going on. That is exactly why avoiding a reply to the stranger who sent it remains the best choice. Instead, open Facebook yourself and check your account for any strange listings or suspicious activity. If you do not see anything wrong, report the text, block the sender and move on immediately. If something looks wrong, secure your Facebook account right away without hesitation.

The bigger concern lies in how easily scammers use pieces of our personal information to make a random text feel legitimate. Your name and phone number may already be available through a data breach, data broker or another source entirely. Seeing accurate information about yourself in an unexpected message should make you more cautious rather than more trusting. Scammers keep finding new ways to use our personal information against us every single day. So who should bear more responsibility for stopping these attacks before they reach our phones? Let us know by writing to the team at CyberGuy.com today.

Sign up for my FREE CyberGuy Newsletter and get tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily. Plus you will get instant access to the Ultimate Scam Survival Guide free when you join today. CLICK HERE TO DOWNLOAD THE FOX NEWS APP for more coverage. Copyright 2026 CyberGuy.com. All rights reserved.