A new scam is circulating by text that puts your own name on a fake Facebook Marketplace listing, then baits you into replying to “correct” it.
Security researchers at Malwarebytes documented the scheme: a text arrives from an unknown number asking “Is this still available for purchase?” along with an image made to look like a Facebook Marketplace listing. The seller’s name on that listing is yours.
The profile photo attached to the fake listing, however, isn’t the recipient’s. Malwarebytes traced it to a different Facebook user who simply shares the same name. That points to scammers working from lists of names and phone numbers pulled from breached data or other sources, then building a convincing fake screenshot around them.
This is what’s called a conversation lure. Rather than demanding a password or dropping an obvious phishing link up front, the message gives you a reason to start typing. Seeing your own name attached to something you never posted is enough to make most people want to respond and set the record straight.
That instinct is the trap. The Federal Trade Commission warns that replying to an unexpected text, even just to say “wrong person,” confirms to a scammer that your number is active and that you’re willing to engage. Malwarebytes notes that a confirmed live number becomes more valuable and can be resold or combined with other personal data to set up future scams, including fake delivery alerts, fake bank messages, or attempts to steal verification codes.
Malwarebytes has not established that AI generated this specific example, but researchers say an attacker armed with a list of names and phone numbers could use automation to produce these personalized fakes at scale. That matters because it means a text that seems to know something personal about you doesn’t actually mean the sender knows you.
What To Do If You Get One
Seeing your name on a fake Marketplace screenshot does not by itself mean your Facebook account has been accessed. Don’t reply to the sender. Instead:
- Open the Facebook app yourself, or type the address directly into your browser, and check your Marketplace activity and messages for anything you didn’t post.
- Review your account for unfamiliar logins or changed contact information.
- Do not click any link, call any number, or scan any QR code sent in the message.
- Never send a one-time security code or a screenshot containing security information to anyone who contacts you this way.
- On iPhone, use Messages’ built-in reporting and blocking tools for unknown senders; Android users can use their messaging app’s spam-reporting features. The FTC also recommends forwarding unwanted texts to 7726 (SPAM).
Apple notes that by default, iPhone users can’t open links from unknown iMessage senders unless they reply or add the sender to contacts — another reason not to engage. Apple also recommends treating unexpected, suspicious messages as potential scams and verifying through a trusted channel rather than the one the message gives you.
If you do find evidence that someone created a fake Facebook profile using your name, save that profile’s URL and report it to Facebook. If you find an unfamiliar login or other signs your account itself was accessed, start Facebook’s account recovery process, change your password, and turn on two-factor authentication under Accounts Center > Password and security > Two-factor authentication.
The underlying problem is simple: your name and phone number are likely already sitting in a data breach or a data-broker database somewhere, available for anyone to buy and weaponize. An accurate personal detail in a random text is not proof of a hack — it’s proof that your information is out there. Treat it as a reason for caution, not trust.
